diff --git a/Advanced setup/DNS options.md b/Advanced setup/DNS options.md new file mode 100644 index 0000000..1e60b1a --- /dev/null +++ b/Advanced setup/DNS options.md @@ -0,0 +1,21 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `DOT` | `on` | `on`, `off` | Activate DNS over TLS with Unbound | +| `DOT_PROVIDERS` | `cloudflare` | `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing` | Comma delimited list of DNS over TLS providers | +| `DOT_CACHING` | `on` | `on`, `off` | Unbound caching | +| `DOT_IPV6` | `off` | `on`, `off` | DNS IPv6 resolution | +| `DOT_PRIVATE_ADDRESS` | All private CIDRs ranges | | Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding | +| `DOT_VERBOSITY` | `1` | `0` to `5` | Unbound verbosity level | +| `DOT_VERBOSITY_DETAILS` | `0` | `0` to `4` | Unbound details verbosity level | +| `DOT_VALIDATION_LOGLEVEL` | `0` | `0` to `2` | Unbound validation log level | +| `DNS_UPDATE_PERIOD` | `24h` | i.e. `0`, `30s`, `5m`, `24h` | Period to update block lists and cryptographic files and restart Unbound. Set to `0` to deactivate updates | +| `BLOCK_MALICIOUS` | `on` | `on`, `off` | Block malicious hostnames and IPs with Unbound | +| `BLOCK_SURVEILLANCE` | `off` | `on`, `off` | Block surveillance hostnames and IPs with Unbound | +| `BLOCK_ADS` | `off` | `on`, `off` | Block ads hostnames and IPs with Unbound | +| `UNBLOCK` | |i.e. `domain1.com,x.domain2.co.uk` | Comma separated list of domain names to leave unblocked with Unbound | +| `DNS_PLAINTEXT_ADDRESS` | `1.1.1.1` | Any IP address | IP address to use as DNS resolver if `DOT` is `off` | +| `DNS_KEEP_NAMESERVER` | `off` | `on` or `off` | Keep the nameservers in /etc/resolv.conf untouched, but disabled DNS blocking features | diff --git a/Setup/Docker secrets.md b/Advanced setup/Docker secrets.md similarity index 69% rename from Setup/Docker secrets.md rename to Advanced setup/Docker secrets.md index 5b6c2c6..0bc87a9 100644 --- a/Setup/Docker secrets.md +++ b/Advanced setup/Docker secrets.md @@ -1,5 +1,7 @@ ![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.docker-secrets) +πŸ’ Note this is **a bit pointless**, since gluetun already takes care of unsetting sensitive environment variables after reading them at start. + If you use Docker Compose or Docker Swarm, you can optionally use [Docker secret files](https://docs.docker.com/engine/swarm/secrets/) for all sensitive values such as your Openvpn credentials, instead of using environment variables. The following secrets can be used: @@ -14,5 +16,3 @@ The following secrets can be used: Note that you can change the secret file path in the container by changing the environment variable in the form `_SECRETFILE`. For example, `OPENVPN_PASSWORD_SECRETFILE` defaults to `/run/secrets/openvpn_password` which you can change. - -πŸ’ This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive environment variables like `OPENVPN_USER` at start. It might be however useful in more advanced setup using Kubernetes for example. diff --git a/Advanced setup/Firewall options.md b/Advanced setup/Firewall options.md new file mode 100644 index 0000000..e718c5f --- /dev/null +++ b/Advanced setup/Firewall options.md @@ -0,0 +1,21 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `FIREWALL` | `on` | `on` or `off` | Turn on or off the container built-in firewall. You should use it for **debugging purposes** only. | +| `FIREWALL_VPN_INPUT_PORTS` | | i.e. `1000,8080` | Comma separated list of ports to allow from the VPN server side (useful for **vyprvpn** port forwarding) | +| `FIREWALL_INPUT_PORTS` | | i.e. `1000,8000` | Comma separated list of ports to allow through the default interface. This seems needed for Kubernetes sidecars. | +| `FIREWALL_DEBUG` | `off` | `on` or `off` | Prints every firewall related command. You should use it for **debugging purposes** only. | +| `FIREWALL_OUTBOUND_SUBNETS` | | i.e. `192.168.1.0/24,192.168.10.121,10.0.0.5/28` | Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications. | + +## Custom iptables rules + +If you need to specify additional iptables rules to be run after the built-in iptables rules, you can use the file at `/iptables/post-rules.txt` with one iptables command per line and these will automatically be run on container start. +For example the `/iptables/post-rules.txt` file could contain: + +```sh +iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p udp --sport 1197 -j ACCEPT +iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p tcp --sport 1197 -j ACCEPT +``` diff --git a/Advanced setup/HTTP control server options.md b/Advanced setup/HTTP control server options.md new file mode 100644 index 0000000..253206b --- /dev/null +++ b/Advanced setup/HTTP control server options.md @@ -0,0 +1,10 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +This is to configure the [HTTP Control server](HTTP Control server). + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `HTTP_CONTROL_SERVER_PORT` | `8000` | `1` to `65535` | Listening port for the HTTP control server | +| `HTTP_CONTROL_SERVER_LOG` | `on` | `on` or `off` | Enable logging of HTTP requests | diff --git a/Advanced setup/HTTP proxy options.md b/Advanced setup/HTTP proxy options.md new file mode 100644 index 0000000..061764a --- /dev/null +++ b/Advanced setup/HTTP proxy options.md @@ -0,0 +1,12 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `HTTPPROXY` | `off` | `on`, `off` | Enable the internal HTTP proxy | +| `HTTPPROXY_LOG` | `off` | `on` or `off` | Logs every tunnel requests | +| `HTTPPROXY_PORT` | `8888` | `1024` to `65535` | Internal port number for the HTTP proxy to listen on | +| `HTTPPROXY_USER` | | | Username to use to connect to the HTTP proxy | +| `HTTPPROXY_PASSWORD` | | | Password to use to connect to the HTTP proxy | +| `HTTPPROXY_STEALTH` | `off` | `on` or `off` | Stealth mode means HTTP proxy headers are not added to your requests | diff --git a/Setup/Openvpn file.md b/Advanced setup/OpenVPN configuration file.md similarity index 100% rename from Setup/Openvpn file.md rename to Advanced setup/OpenVPN configuration file.md diff --git a/Advanced setup/OpenVPN options.md b/Advanced setup/OpenVPN options.md new file mode 100644 index 0000000..bfb8046 --- /dev/null +++ b/Advanced setup/OpenVPN options.md @@ -0,0 +1,17 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `PROTOCOL` | `udp` | `udp` or `tcp` | Network protocol to use, only valid for OpenVPN | +| `OPENVPN_VERSION` | `2.5` | `2.4` or `2.5` | Set the OpenVPN version to run | +| `OPENVPN_VERBOSITY` | `1` | `0` to `6` | Openvpn verbosity level | +| `OPENVPN_FLAGS` | | Openvpn flags | Space delimited openvpn flags to pass to `openvpn` | +| `OPENVPN_ROOT` | `no` | `yes` or `no` | Run OpenVPN as root | +| `OPENVPN_TARGET_IP` | | Valid IP address | Specify a target VPN IP address to use | +| `OPENVPN_CIPHER` | | i.e. `aes-256-gcm` | Specify a custom cipher to use. It will also set `ncp-disable` if using AES GCM for PIA | +| `OPENVPN_AUTH` | | i.e. `sha256` | Specify a custom auth algorithm to use | +| `OPENVPN_IPV6` | `off` | `on`, `off` | Enable tunneling of IPv6 (only for Mullvad) | +| `OPENVPN_MSSFIX` | `0` | `0` to `9999` | Set the MSS fix parameter. Set to `0` to use the defaults. | +| `OPENVPN_INTERFACE` | `tun0` | Any interface name | Specify a custom network interface name to use | diff --git a/Advanced setup/Other options.md b/Advanced setup/Other options.md new file mode 100644 index 0000000..f119ea7 --- /dev/null +++ b/Advanced setup/Other options.md @@ -0,0 +1,13 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `TZ` | | i.e. `Europe/London` | Specify a timezone to use to have correct log times | +| `PUID` | `1000` | | User ID to run as non root and for ownership of files written | +| `PGID` | `1000` | | Group ID to run as non root and for ownership of files written | +| `PUBLICIP_PERIOD` | `12h` | Valid duration | Period to check for public IP address. Set to `0` to disable. | +| `PUBLICIP_FILE` | `/tmp/gluetun/ip` | Any filepath | Filepath to store the public IP address assigned. This will be removed in the `v4` program, instead you might want to use the [HTTP control server](HTTP-control-server) | +| `VERSION_INFORMATION` | `on` | `on`, `off` | Logs a message indicating if a newer version is available once the VPN is connected | +| `UPDATER_PERIOD` | `0` | Valid duration string such as `24h` | Period to update all VPN servers information in memory and to /gluetun/servers.json. Set to `0` to disable. This does a burst of DNS over TLS requests, which may be blocked if you set `BLOCK_MALICIOUS=on` for example. | diff --git a/Servers/Servers Readme.md b/Advanced setup/Outdated servers.md similarity index 70% rename from Servers/Servers Readme.md rename to Advanced setup/Outdated servers.md index e145602..e6222d7 100644 --- a/Servers/Servers Readme.md +++ b/Advanced setup/Outdated servers.md @@ -1,21 +1,10 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.readme) - -## Servers Readme - -This directory contains tables of servers information at the time of writing this document. -It also contains [a document describing how to update your server information locally](Updating-Servers). - -πŸ’ For each VPN provider there is a corresponding document, such as [Windscribe Servers](Windscribe-Servers). - -### Obtain up to date information - -⚠️ The servers information in the Wiki might get outdated, so you have the following options to obtain up to date information: +If you encounter some server information which is outdated, you can do the following: 1. [Try environment variables](Try-environment-variables) 1. [Check the repository servers.json](Check-the-repository-servers.json) 1. [Check your servers.json](Check-your-servers.json) -#### Try environment variables +### Try environment variables You can try environment variables, such as setting `REGION=somevalue` and the program will exit, stating which options are available depending on the VPN service provider selected. For example: @@ -32,10 +21,11 @@ INFO Shutdown successful #### Check the repository servers.json -There is a [`internal/constants/servers.json`](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/constants/servers.json) file containing all the server information for each VPN service provider in JSON format. +There is a [`internal/storage/servers.json`](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json) file containing all the server information for each VPN service provider in JSON format. -- For the latest image `qmcgaw/gluetun`, you can check the [master branch servers.json](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/constants/servers.json) -- For tagged images `qmcgaw/gluetun:v3.x.x` after `v3.20.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.20.0/internal/constants/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.20.0/internal/constants/servers.json) for release image tag `v3.21.0` +- For the latest image `qmcgaw/gluetun`, you can check the [master branch servers.json](https://raw.githubusercontent.com/qdm12/gluetun/master/internal/storage/servers.json) +- For tagged images `qmcgaw/gluetun:v3.x.x` from `v3.24.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.24.0/internal/storage/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.24.0/internal/storage/servers.json) for release image tag `v3.24.0` +- For tagged images `qmcgaw/gluetun:v3.x.x` from `v3.21.0`, you can check the servers.json in the corresponding tree. For example at [raw.githubusercontent.com/qdm12/gluetun/v3.21.0/internal/constants/servers.json](https://raw.githubusercontent.com/qdm12/gluetun/v3.21.0/internal/constants/servers.json) for release image tag `v3.21.0` - For tagged images `qmcgaw/gluetun:v3.x.x` before `v3.21.0`, you can check the Go files in the constants directory in the corresponding tree for example at [github.com/qdm12/gluetun/tree/v3.17.0/internal/constants](https://github.com/qdm12/gluetun/tree/v3.20.0/internal/constants/servers.json) for release image tag `v3.17.0` ⚠️ Note that if you update the server information yourself more recently than the server information in the source code, this approach does not work and your `servers.json` file takes precedence. See the section below in this case. diff --git a/Advanced setup/Shadowsocks options.md b/Advanced setup/Shadowsocks options.md new file mode 100644 index 0000000..e846437 --- /dev/null +++ b/Advanced setup/Shadowsocks options.md @@ -0,0 +1,11 @@ +## Environment variables + +πŸ’ The following environment variables are all optional. + +| Variable | Default | Choices | Description | +| --- | --- | --- | --- | +| `SHADOWSOCKS` | `off` | `on`, `off` | Enable the internal Shadowsocks proxy | +| `SHADOWSOCKS_LOG` | `off` | `on`, `off` | Enable logging | +| `SHADOWSOCKS_ADDRESS` | `:8388` | Listening address | Internal listening address for Shadowsocks | +| `SHADOWSOCKS_PASSWORD` | | | Password to use to connect to Shadowsocks | +| `SHADOWSOCKS_CIPHER` | `chacha20-ietf-poly1305` | `chacha20-ietf-poly1305`, `aes-128-gcm`, `aes-256-gcm` | AEAD Cipher to use for Shadowsocks | diff --git a/Servers/Updating Servers.md b/Advanced setup/Updating servers.md similarity index 100% rename from Servers/Updating Servers.md rename to Advanced setup/Updating servers.md diff --git a/Advanced setup/VPN server port forwarding.md b/Advanced setup/VPN server port forwarding.md new file mode 100644 index 0000000..8749723 --- /dev/null +++ b/Advanced setup/VPN server port forwarding.md @@ -0,0 +1,34 @@ +πŸ’ Each VPN service provider supporting port forwarding have their own section on their own page on how to set it up. + +πŸ”΄ This is **NOT** about [Docker port mapping](Port-mapping) + +## Test it + +Assuming: + +- your gluetun container name is `gluetun` +- your VPN public IP address is `99.99.99.99` +- your VPN port forwarded is `8888` + +You can test it with: + +```sh +docker exec -it gluetun /bin/sh +# Change amd64 to your CPU architecture +wget -qO port-checker https://github.com/qdm12/port-checker/releases/download/v0.3.0/port-checker_0.3.0_linux_amd64 +chmod +x port-checker +./port-checker -port 8888 +``` + +Then in your browser, access [http://99.99.99.99:8888](http://99.99.99.99:8888). + +It should show you your browser IP address and user agent. +You should also see the request logged in the port-checker output. + +Finally, back to the terminal, press `CTRL+C` to stop port-checker and enter `exit` to quit the interactive shell in `gluetun`. + +## Deluge + +[@jawilson](https://github.com/jawilson) developed a plugin to automagically update the forwarded port in Deluge: [**deluge-piaportplugin**](https://github.com/jawilson/deluge-piaportplugin) + +Feel free to thank him on his repository πŸ‘ diff --git a/FAQ/Bandwidth speeds.md b/FAQ/Bandwidth speeds.md index 2c6a27d..3aa2475 100644 --- a/FAQ/Bandwidth speeds.md +++ b/FAQ/Bandwidth speeds.md @@ -38,7 +38,6 @@ I ran multiple tests using different clients, servers and regions to clarify all | --- | --- | --- | --- | --- | --- | | `windows` | Windows | Docker desktop on WSL2 | AMD 5900x | `amd64` | `24` | | `arch` | Arch Linux | Docker | AMD 2600x | `amd64` | `12` | - | `rpi4` | Raspbian 32 bit | Docker | Raspberry Pi 4 A72 | `arm64` | `4` | - We use `speedtest-cli` to test the bandwidth on all speedtest hosts with: diff --git a/FAQ/Explanations.md b/FAQ/Explanations.md index 2388749..d2e0096 100644 --- a/FAQ/Explanations.md +++ b/FAQ/Explanations.md @@ -1,4 +1,13 @@ -The following document explains different aspects of gluetun and how it works. +## What files does it download after tunneling + +If `DOT=off`, Unbound won't run and therefore no file will be downloaded by the program at all. + +If `DOT=on`, after tunneling, it downloads at start (and periodically if `DNS_UPDATE_PERIOD` is not `0`): + +- [DNS named root](https://github.com/qdm12/files/blob/master/named.root.updated) and the [DNS root key](https://github.com/qdm12/files/blob/master/root.key.updated) for Unbound +- If `BLOCK_MALICIOUS=on`: [Malicious hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound +- If `BLOCK_SURVEILLANCE=on`: [Surveillance hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound +- If `BLOCK_ADS=on`: [Ads hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound ## Server information @@ -13,3 +22,19 @@ These however can get outdated. In this case, you have multiple options: - Pull the latest Docker image `docker pull qmcgaw/gluetun`. I update myself the server information *hardcoded* in the program from time to time, so you will get new ones by updating gluetun. - Follow the [Updating Servers](Updating-Servers#cli-operation) guide if none of the servers work. Ideally, you can still find one VPN server working, connect to it and just set `-e UPDATE_PERIOD=24h` so server information is fully updated every 24 hours. On a container restart or settings change, gluetun will pick up the server information you just updated from `/gluetun/servers.json` and use it. + +## What is all this Go code + +The Go code was essentially a big rewrite of the previous shell entrypoint. +It now acts a supervisor program, and has a built-in HTTP control server. + +It allows for: + +- better testing +- better maintainability +- ease of implementing new features +- faster start time +- asynchronous/parallel operations +- Restarting openvpn/unbound when needed without quitting the container + +It is mostly made of the [internal directory](https://github.com/qdm12/gluetun/tree/master/internal) and the entry Go file [cmd/main.go](https://github.com/qdm12/gluetun/blob/master/cmd/gluetun/main.go). diff --git a/FAQ/Iptables errors.md b/FAQ/Iptables errors.md new file mode 100644 index 0000000..a154664 --- /dev/null +++ b/FAQ/Iptables errors.md @@ -0,0 +1,24 @@ +## `Table does not exist (do you need to insmod?)` + +This is common on Raspberry Pis. + +If you encounter the error: + +```log +iptables v1.8.4 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) +``` + +You likely need to update your system with `rpi-update`, see [#400](https://github.com/qdm12/gluetun/issues/400) for more information. + +## `Permission denied (you must be root)` + +If you use Portainer to run the container and get the error: + +```log +2020-05-03T09:04:11.283Z ERROR failed executing "-P INPUT ACCEPT": iptables v1.8.3 (legacy): can't initialize iptables table `filter': Permission denied (you must be root) +Perhaps iptables or your kernel needs to be upgraded.: exit status 3``` +``` + +This might be because Portainer does not set the `--cap_add=NET_ADMIN` successfully. + +You might need to run the container without Portainer in this case. More information on [#139](https://github.com/qdm12/gluetun/issues/139). diff --git a/FAQ/Mullvad.md b/FAQ/Mullvad.md deleted file mode 100644 index 9634960..0000000 --- a/FAQ/Mullvad.md +++ /dev/null @@ -1,24 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.mullvad) - -## IPv6 - -If you want to tunnel IPv6 with Mullvad, follow the following. - -1. Ensure your Kernel has IPv6 - - ```sh - lsmod | grep ipv6 - ``` - - Should show something. -1. Set the environment variable `OPENVPN_IPV6` to `on` -1. Enable IPv6 in Docker for this container: - - For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems) - - For docker-compose.yml files, add this to your `gluetun` config block: - - ```yml - sysctls: - - net.ipv6.conf.all.disable_ipv6=0 - ``` - -1. Start the container diff --git a/FAQ/Openvpn.md b/FAQ/OpenVPN errors.md similarity index 53% rename from FAQ/Openvpn.md rename to FAQ/OpenVPN errors.md index 2ffcf02..cfe9392 100644 --- a/FAQ/Openvpn.md +++ b/FAQ/OpenVPN errors.md @@ -1,5 +1,3 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.openvpn) - ## Inconsistence warnings You might see some warnings for Private Internet Access and others, similar to: @@ -16,32 +14,6 @@ It is mainly because the option [disable-occ](https://openvpn.net/community-reso Private Internet Access explains [here why](https://www.privateinternetaccess.com/helpdesk/kb/articles/why-do-i-get-cipher-auth-warnings-when-i-connect) the warnings show up. -## Exiting on ping timeout - -If your Openvpn drops the connection because of a ping timeout, the container will exit -and connected containers will lose their connection to it, even if it restarts. - -You will obtain an error similar to: - -```s -openvpn: Wed Mar 18 22:13:00 2020 [3a51ae90324bcb0719cb399b650c64d4] Inactivity timeout (--ping-restart), restarting, -openvpn: Wed Mar 18 22:13:00 2020 SIGUSR1[soft,ping-restart] received, process restarting, -... -openvpn: Wed Mar 18 22:13:17 2020 Preserving previous TUN/TAP instance: tun0, -openvpn: Wed Mar 18 22:13:17 2020 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device., -openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2, -openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2, -openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2, -openvpn: Wed Mar 18 22:13:17 2020 ERROR: Linux route delete command failed: external program exited with error status: 2, -openvpn: Wed Mar 18 22:13:17 2020 /sbin/ip addr del dev tun0 local 10.6.11.6 peer 10.6.11.5, -openvpn: Wed Mar 18 22:13:17 2020 Linux ip addr del failed: external program exited with error status: 2, -openvpn: Wed Mar 18 22:13:18 2020 ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1), -openvpn: Wed Mar 18 22:13:18 2020 Exiting due to fatal error, -exit status 1 -``` - -To allow openvpn to restart itself, run openvpn with root by setting the environment variable `OPENVPN_ROOT=yes`. - ## Interrupted system call It may happen, quite rarely though, that Openvpn is killed in a loop by the host system. diff --git a/FAQ/Portainer.md b/FAQ/Portainer.md deleted file mode 100644 index e60f6d6..0000000 --- a/FAQ/Portainer.md +++ /dev/null @@ -1,12 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.portainer) - -## Iptables permission - -If you use Portainer to run the container and get the error: - -``` -2020-05-03T09:04:11.283Z ERROR failed executing "-P INPUT ACCEPT": iptables v1.8.3 (legacy): can't initialize iptables table `filter': Permission denied (you must be root) -Perhaps iptables or your kernel needs to be upgraded.: exit status 3``` -``` - -This might be because portainer does not set the `--cap_add=NET_ADMIN` successfully. You might need to run the container without Portainer in this case. More information on [this issue](https://github.com/qdm12/gluetun/issues/139). diff --git a/FAQ/Raspberry Pi.md b/FAQ/Raspberry Pi.md deleted file mode 100644 index 3579692..0000000 --- a/FAQ/Raspberry Pi.md +++ /dev/null @@ -1,11 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.faq.raspberrypi) - -## Iptables error - -If you encounter the error - -```log -iptables v1.8.4 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?) -``` - -You might need to update with `rpi-update`, see #400 for more information. diff --git a/Home.md b/Home.md index 171ff31..379986a 100644 --- a/Home.md +++ b/Home.md @@ -8,4 +8,27 @@ You can navigate pages on the right side bar πŸ‘‰ -There are pages about the container setup, advanced configuration, servers updating, FAQ and contributing documentation. +If this is your first time: + +- Are you a Raspberry Pi user? Check out the [32 bit prerequisites page](32-bit-prerequisites) +- Are you a Synology user? Check out the [Synology prerequisites page](Synology-prerequisites) +- Are you a 32 bit OS user? Check out the [32 bit prerequisites page](32-bit-prerequisites) + +And then pick your VPN provider on the right and start from there! + +Do you want to use *Wireguard* with a custom configuration? Check out the [Custom provider page](Custom-provider) + +Other important optional pages: + +- [Connect a container to gluetun](Connect-a-container-to-gluetun) +- [Connect a LAN device to gluetun](Connect-a-LAN-device-to-gluetun) +- [Port mapping](Port-mapping) +- [Docker image tags](Docker-image-tags) + +If you encounter issues: + +1. Please check one of the page of the FAQ from the righ side bar πŸ‘‰ +2. Please open a [Github discussion](https://github.com/qdm12/gluetun/discussions/new) +3. If it's definitely a bug, please create a [Github issue](https://github.com/qdm12/gluetun/issues/new/choose) + +πŸ› Found a bug in the Wiki?! [Please create an issue](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.md&title=Wiki+issue%3A+) diff --git a/More-information.md b/More-information.md deleted file mode 100644 index 2ce5e10..0000000 --- a/More-information.md +++ /dev/null @@ -1,38 +0,0 @@ -## Table of content - -1. [What is all this Go code](#What-is-all-this-Go-code) -1. [What files does it download after tunneling](#What-files-does-it-download-after-tunneling) -1. [Healthcheck](#Healthcheck) - -## What is all this Go code - -The Go code was essentially a big rewrite of the previous shell entrypoint. -It now acts a supervisor program, and has a built-in HTTP control server. - -It allows for: - -- better testing -- better maintainability -- ease of implementing new features -- faster start time -- asynchronous/parallel operations -- Restarting openvpn/unbound when needed without quitting the container - -It is mostly made of the [internal directory](../internal) and the entry Go file [cmd/main.go](../cmd/main.go). - -## What files does it download after tunneling - -If `DOT=off`, Unbound won't run and therefore no file will be downloaded by the program at all. - -If `DOT=on`, after tunneling, it downloads at start (and periodically if `DNS_UPDATE_PERIOD` is not `0`): - -- [DNS named root](https://github.com/qdm12/files/blob/master/named.root.updated) and the [DNS root key](https://github.com/qdm12/files/blob/master/root.key.updated) for Unbound -- If `BLOCK_MALICIOUS=on`: [Malicious hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound -- If `BLOCK_SURVEILLANCE=on`: [Surveillance hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound -- If `BLOCK_ADS=on`: [Ads hostnames and IP addresses block lists](https://github.com/qdm12/files) for Unbound - -## Healthcheck - -For Docker, docker-compose and Docker Swarm, there is a built-in [Docker healthcheck](https://docs.docker.com/engine/reference/builder/#healthcheck) running periodically which verifies DNS resolution of github.com is working, to ensure DNS over TLS **and** the Openvpn connection are both working. - -If this is bothering you, you [can disable it](Advanced-setup#Disable-the-healthcheck). diff --git a/Servers/Ivpn Servers.md b/Servers/Ivpn Servers.md deleted file mode 100644 index 81c7808..0000000 --- a/Servers/Ivpn Servers.md +++ /dev/null @@ -1,49 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.ivpn) - -The list of servers for IVPN is shown below: - -| Country | City | Hostname | -| --- | --- | --- | -| Australia | | `au-nsw.gw.ivpn.net` | -| Austria | | `at.gw.ivpn.net` | -| Belgium | | `be.gw.ivpn.net` | -| Brazil | | `br.gw.ivpn.net` | -| Canada | Montreal | `ca-qc.gw.ivpn.net` | -| Canada | Toronto | `ca.gw.ivpn.net` | -| Czech Republic | | `cz.gw.ivpn.net` | -| Denmark | | `dk.gw.ivpn.net` | -| Finland | | `fi.gw.ivpn.net` | -| France | | `fr.gw.ivpn.net` | -| Germany | | `de.gw.ivpn.net` | -| Hong Kong | | `hk.gw.ivpn.net` | -| Hungary | | `hu.gw.ivpn.net` | -| Iceland | | `is.gw.ivpn.net` | -| Israel | | `il.gw.ivpn.net` | -| Italy | | `it.gw.ivpn.net` | -| Japan | | `jp.gw.ivpn.net` | -| Luxembourg | | `lu.gw.ivpn.net` | -| Netherlands | | `nl.gw.ivpn.net` | -| Norway | | `no.gw.ivpn.net` | -| Poland | | `pl.gw.ivpn.net` | -| Portugal | | `pt.gw.ivpn.net` | -| Romania | | `ro.gw.ivpn.net` | -| Serbia | | `rs.gw.ivpn.net` | -| Singapore | | `sg.gw.ivpn.net` | -| Slovakia | | `sk.gw.ivpn.net` | -| Sweden | | `se.gw.ivpn.net` | -| Switzerland | | `ch.gw.ivpn.net` | -| USA | Atlanta | `us-ga.gw.ivpn.net` | -| USA | Chicago | `us-il.gw.ivpn.net` | -| USA | Dallas | `us-tx.gw.ivpn.net` | -| USA | Las Vegas | `us-nv.gw.ivpn.net` | -| USA | Los Angeles | `us-ca.gw.ivpn.net` | -| USA | Miami | `us-fl.gw.ivpn.net` | -| USA | New Jersey | `us-nj.gw.ivpn.net` | -| USA | New York | `us-ny.gw.ivpn.net` | -| USA | Phoenix | `us-az.gw.ivpn.net` | -| USA | Salt Lake City | `us-ut.gw.ivpn.net` | -| USA | Seattle | `us-wa.gw.ivpn.net` | -| USA | Washington | `us-dc.gw.ivpn.net` | -| Ukraine | | `ua.gw.ivpn.net` | -| United Kingdom | London | `gb.gw.ivpn.net` | -| United Kingdom | Manchester | `gb-man.gw.ivpn.net` | diff --git a/Servers/Nordvpn Servers.md b/Servers/Nordvpn Servers.md deleted file mode 100644 index ddef037..0000000 --- a/Servers/Nordvpn Servers.md +++ /dev/null @@ -1,5 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.nordvpn) - -The list of servers for NordVPN is available in the [source code](https://github.com/qdm12/gluetun/blob/master/internal/constants/nordvpn.go#L46). - -The table of servers cannot be put here unfortunately as there are too many servers and the Github markdown engine then fails. diff --git a/Servers/VPN Unlimited Servers.md b/Servers/VPN Unlimited Servers.md deleted file mode 100644 index f36baf1..0000000 --- a/Servers/VPN Unlimited Servers.md +++ /dev/null @@ -1,84 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.vpnunlimited) - -The list of servers for VPN Unlimited (KeepSolid) is shown below: - -| Country | City | Hostname | Free | Stream | -| --- | --- | --- | --- | --- | -| Argentina | | `ar.vpnunlimitedapp.com` | no | no | -| Australia | Sydney | `au-syd.vpnunlimitedapp.com` | no | no | -| Austria | | `at.vpnunlimitedapp.com` | no | no | -| Belarus | | `by.vpnunlimitedapp.com` | no | no | -| Belgium | | `be.vpnunlimitedapp.com` | no | no | -| Bosnia and Herzegovina | | `ba.vpnunlimitedapp.com` | no | no | -| Brazil | | `br.vpnunlimitedapp.com` | no | no | -| Bulgaria | | `bg.vpnunlimitedapp.com` | no | no | -| Canada | | `ca.vpnunlimitedapp.com` | no | no | -| Canada | Toronto | `ca-tr.vpnunlimitedapp.com` | no | no | -| Canada | Vancouver | `ca-vn.vpnunlimitedapp.com` | no | no | -| Costa Rica | | `cr.vpnunlimitedapp.com` | no | no | -| Croatia | | `hr.vpnunlimitedapp.com` | no | no | -| Cyprus | | `cy.vpnunlimitedapp.com` | no | no | -| Czech Republic | | `cz.vpnunlimitedapp.com` | no | no | -| Denmark | | `dk.vpnunlimitedapp.com` | no | no | -| Estonia | | `ee.vpnunlimitedapp.com` | no | no | -| Finland | | `fi.vpnunlimitedapp.com` | no | no | -| France | | `fr.vpnunlimitedapp.com` | no | no | -| France | Roubaix | `fr-rbx.vpnunlimitedapp.com` | no | no | -| Germany | | `de.vpnunlimitedapp.com` | no | no | -| Germany | DΓΌsseldorf | `de-dus.vpnunlimitedapp.com` | no | no | -| Greece | | `gr.vpnunlimitedapp.com` | no | no | -| Hungary | | `hu.vpnunlimitedapp.com` | no | no | -| Iceland | | `is.vpnunlimitedapp.com` | no | no | -| India | | `in.vpnunlimitedapp.com` | no | no | -| India | Karnataka | `in-ka.vpnunlimitedapp.com` | no | no | -| Ireland | Dublin | `ie-dub.vpnunlimitedapp.com` | no | no | -| Isle of Man | | `im.vpnunlimitedapp.com` | no | no | -| Israel | | `il.vpnunlimitedapp.com` | no | no | -| Italy | Milan | `it-mil.vpnunlimitedapp.com` | no | no | -| Japan | | `jp.vpnunlimitedapp.com` | no | no | -| Korea | | `kr.vpnunlimitedapp.com` | no | no | -| Kuala Lumpur | | `mys.vpnunlimitedapp.com` | no | no | -| Latvia | | `lv.vpnunlimitedapp.com` | no | no | -| Libya | | `ly.vpnunlimitedapp.com` | no | no | -| Lithuania | | `lt.vpnunlimitedapp.com` | no | no | -| Luxembourg | | `lu.vpnunlimitedapp.com` | no | no | -| Mexico | | `mx.vpnunlimitedapp.com` | no | no | -| Moldova | | `md.vpnunlimitedapp.com` | no | no | -| Netherlands | | `nl.vpnunlimitedapp.com` | no | no | -| New Zealand | | `nz.vpnunlimitedapp.com` | no | no | -| Norway | | `no.vpnunlimitedapp.com` | no | no | -| Oman | | `om.vpnunlimitedapp.com` | no | no | -| Poland | | `pl.vpnunlimitedapp.com` | no | no | -| Portugal | | `pt.vpnunlimitedapp.com` | no | no | -| Romania | | `ro.vpnunlimitedapp.com` | no | no | -| Serbia | | `rs.vpnunlimitedapp.com` | no | no | -| Singapore | | `sg-free.vpnunlimitedapp.com` | yes | no | -| Singapore | | `sg.vpnunlimitedapp.com` | no | no | -| Slovakia | | `sk.vpnunlimitedapp.com` | no | no | -| Slovenia | | `si.vpnunlimitedapp.com` | no | no | -| South Africa | | `za.vpnunlimitedapp.com` | no | no | -| Spain | | `es.vpnunlimitedapp.com` | no | no | -| Sweden | | `se.vpnunlimitedapp.com` | no | no | -| Switzerland | | `ch.vpnunlimitedapp.com` | no | no | -| Thailand | | `th.vpnunlimitedapp.com` | no | no | -| Turkey | | `tr.vpnunlimitedapp.com` | no | no | -| United Arab Emirates | | `ae.vpnunlimitedapp.com` | no | no | -| United Kingdom | | `uk.vpnunlimitedapp.com` | no | no | -| United Kingdom | London | `uk-cv.vpnunlimitedapp.com` | no | no | -| United Kingdom | London | `uk-lon.vpnunlimitedapp.com` | no | no | -| United States | | `us-stream.vpnunlimitedapp.com` | no | yes | -| United States | | `us.vpnunlimitedapp.com` | no | no | -| United States | Chicago | `us-chi.vpnunlimitedapp.com` | no | no | -| United States | Dallas | `us-dal.vpnunlimitedapp.com` | no | no | -| United States | Denver | `us-den.vpnunlimitedapp.com` | no | no | -| United States | Houston | `us-hou.vpnunlimitedapp.com` | no | no | -| United States | Las Vegas | `us-lv.vpnunlimitedapp.com` | no | no | -| United States | Los Angeles | `us-la.vpnunlimitedapp.com` | no | no | -| United States | Miami | `us-mia.vpnunlimitedapp.com` | no | no | -| United States | New York | `us-ny-free.vpnunlimitedapp.com` | yes | no | -| United States | New York | `us-ny.vpnunlimitedapp.com` | no | no | -| United States | Saint Louis | `us-sl.vpnunlimitedapp.com` | no | no | -| United States | Salt Lake City | `us-slc.vpnunlimitedapp.com` | no | no | -| United States | San Francisco | `us-sf.vpnunlimitedapp.com` | no | no | -| United States | Seattle | `us-sea.vpnunlimitedapp.com` | no | no | -| Vietnam | | `vn.vpnunlimitedapp.com` | no | no | diff --git a/Servers/WeVPN Servers.md b/Servers/WeVPN Servers.md deleted file mode 100644 index 8f420d8..0000000 --- a/Servers/WeVPN Servers.md +++ /dev/null @@ -1,7 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.wevpn) - -The list of servers for WeVPN is shown below: - -| City | Hostname | -| --- | --- | -| Los Angeles | `losangeles.wevpn.com` | diff --git a/Setup/Advanced setup.md b/Setup/Advanced setup.md deleted file mode 100644 index 9e1c356..0000000 --- a/Setup/Advanced setup.md +++ /dev/null @@ -1,20 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.advanced) - -## Custom iptables rules - -If you need to specify additional iptables rules to be run after the built-in iptables rules, you can use the file at `/iptables/post-rules.txt` with one iptables command per line and these will automatically be run on container start. -For example the `/iptables/post-rules.txt` file could contain: - -```sh -iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p udp --sport 1197 -j ACCEPT -iptables -A INPUT -i eth0 -s 0.0.0.0/0 -d 192.168.2.0/24 -p tcp --sport 1197 -j ACCEPT -``` - -## Disable the healthcheck - -If the Docker healthcheck (not running in Kubernetes) is bothering you because it accesses ip echo websites periodically, you can disable with `--no-healthcheck` or for docker-compose.yml: - -```yml - healthcheck: - disable: true -``` diff --git a/Setup/Client certificate.md b/Setup/Client certificate.md deleted file mode 100644 index 599bef1..0000000 --- a/Setup/Client certificate.md +++ /dev/null @@ -1,43 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-certificate) - -πŸ›‘ These instructions are only for specific VPN providers, such as Cyberghost. You should not read this if it not mentioned. - -Your client certificate is usually of the form: - -```pem ------BEGIN CERTIFICATE----- -... -... ------END CERTIFICATE----- -``` - -It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider. - -First, you need to take your client certificat (from its start line `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`) and place it in a file on your host that we name `client.crt` - -The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can: - -1. Move `client.crt` to `/yourpath/gluetun/client.crt` on your host -1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun` - -If you use Docker Compose or Docker Swarm, you can optionally use a [Docker secret file](https://docs.docker.com/engine/swarm/secrets/), using the secret name `openvpn_clientcrt`. - -For example: - -```yml -version: "3" -services: - gluetun: - image: qmcgaw/gluetun - # ... - secrets: - - openvpn_clientcrt - -secrets: - openvpn_clientcrt: - file: ./client.crt -``` - -πŸ’ This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive variables like `OPENVPN_USER` at start. - -If you need it, you can also change the default client certificate secret file path (`/run/secrets/openvpn_clientcrt`) by setting `-e OPENVPN_CLIENTCRT_SECRETFILE=/run/secrets/anothername` for example, where the secret would then need to be `anothername` instead of `openvpn_clientcrt`. diff --git a/Setup/Client key.md b/Setup/Client key.md deleted file mode 100644 index 89c28eb..0000000 --- a/Setup/Client key.md +++ /dev/null @@ -1,43 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-key) - -πŸ›‘ These instructions are only for specific VPN providers, such as Cyberghost and VPN Unlimited. You should not read this if it not mentioned. - -Your client key is usually of the form: - -```pem ------BEGIN PRIVATE KEY----- -... -... ------END PRIVATE KEY----- -``` - -It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider. - -First, you need to take your key (from its start line `-----BEGIN PRIVATE KEY-----` to `-----END PRIVATE KEY-----`) and place it in a file on your host that we name `client.key`. - -The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can: - -1. Move `client.key` to `/yourpath/gluetun/client.key` on your host -1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun` - -If you use Docker Compose or Docker Swarm, you can optionally use a [Docker secret file](https://docs.docker.com/engine/swarm/secrets/), using the secret name `openvpn_clientkey`. - -For example: - -```yml -version: "3" -services: - gluetun: - image: qmcgaw/gluetun - # ... - secrets: - - openvpn_clientkey - -secrets: - openvpn_clientkey: - file: ./client.key -``` - -πŸ’ This is really more of an option than a necessity, since all these sensitive inputs are read by gluetun and then written as files in the container, and gluetun already takes care of unsetting sensitive variables like `OPENVPN_USER` at start. - -If you need it, you can also change the default client key secret file path (`/run/secrets/openvpn_clientkey`) by setting `-e OPENVPN_CLIENTKEY_SECRETFILE=/run/secrets/anothername` for example, where the secret would then need to be `anothername` instead of `openvpn_clientkey`. diff --git a/Setup/Connect to gluetun.md b/Setup/Connect a LAN device to gluetun.md similarity index 74% rename from Setup/Connect to gluetun.md rename to Setup/Connect a LAN device to gluetun.md index 7b13b7e..c746b60 100644 --- a/Setup/Connect to gluetun.md +++ b/Setup/Connect a LAN device to gluetun.md @@ -1,24 +1,8 @@ ![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.connect-to-gluetun) -There are various ways to connect a container or device to Gluetun, as described below. +There are various ways to connect a device to Gluetun. -πŸ’‘ If you are connecting containers to Gluetun's network stack, you might want to also check the [Port mapping page](Port-mapping) to know how to access ports of containers connected to Gluetun. - -## Container in the same docker-compose.yml - -Add `network_mode: "service:gluetun"` to your second container so that it uses the `gluetun` network stack. - -There is no need for `depends_on`. - -## External container to Gluetun - -Add `--network=container:gluetun` when launching the container, provided Gluetun is already running. - -## Container in another docker-compose.yml - -Add `network_mode: "container:gluetun"` to your *docker-compose.yml*, provided Gluetun is already running. - -## Devices with the HTTP proxy +## HTTP proxy This is useful for some clients such as Chrome, Firefox or Kodi. @@ -31,7 +15,7 @@ This is useful for some clients such as Chrome, Firefox or Kodi. 1. With your HTTP proxy client, connect to the Docker host (i.e. `192.168.1.10`) on port `8888`. You need to enter your credentials if you set them with `HTTPPROXY_USER` and `HTTPPROXY_PASSWORD`. Note that Chrome does not support authentication. 1. If you set `HTTPPROXY_LOG` to `on`, more information will be logged in the Docker logs. -## Devices with the Shadowsocks proxy +## Shadowsocks proxy 1. Setup a Shadowsocks proxy client, there is a list of [ShadowSocks clients for **all platforms**](https://shadowsocks.org/en/download/clients.html) - **note** some clients do not tunnel UDP so your DNS queries will be done locally and not through Gluetun and its built in DNS over TLS diff --git a/Setup/Connect a container to gluetun.md b/Setup/Connect a container to gluetun.md new file mode 100644 index 0000000..59f9637 --- /dev/null +++ b/Setup/Connect a container to gluetun.md @@ -0,0 +1,19 @@ +![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.connect-to-gluetun) + +There are various ways to connect a container to Gluetun. + +πŸ’‘ If you are connecting containers to Gluetun's network stack, you might want to also check the [Port mapping page](Port-mapping) to know how to access ports of containers connected to Gluetun. + +## Container in the same docker-compose.yml + +Add `network_mode: "service:gluetun"` to your second container so that it uses the `gluetun` network stack. + +There is no need for `depends_on`. + +## External container to Gluetun + +Add `--network=container:gluetun` when launching the container, provided Gluetun is already running. + +## Container in another docker-compose.yml + +Add `network_mode: "container:gluetun"` to your *docker-compose.yml*, provided Gluetun is already running. diff --git a/FAQ/Docker image tags.md b/Setup/Docker image tags.md similarity index 90% rename from FAQ/Docker image tags.md rename to Setup/Docker image tags.md index 301a060..bf7b8db 100644 --- a/FAQ/Docker image tags.md +++ b/Setup/Docker image tags.md @@ -7,10 +7,16 @@ If it happens to be **broken**, this page is for you. ℹ️ [Live list of image tags **after v3.9.0**](https://hub.docker.com/r/qmcgaw/gluetun/tags?page=1&ordering=last_updated) +[Multiple releases](https://github.com/qdm12/gluetun/releases) are made through time when the image is considered stable. + +Each time a Github release is made, an associated Docker image tag is made, for example a `v3.1.0` release produces the image `qmcgaw/gluetun:v3.1.0`. + +You can thus use one of these image tags if `:latest` doesn't work for you. Also, don't forget to [create an issue](https://github.com/qdm12/gluetun/issues/new/choose) for it πŸ˜‰ + +The following is for release tags before `v3.10.0`: + | Image | Github release | CPU architectures | | --- | --- | --- | -| `qmcgaw/gluetun:v3.11.1` | [v3.11.1](https://github.com/qdm12/gluetun/releases/tag/v3.11.1) | 386, amd64, armv6, armv7, arm64, s390x, ppc64le | -| `qmcgaw/gluetun:v3.10.3` | [v3.10.3](https://github.com/qdm12/gluetun/releases/tag/v3.10.3) | 386, amd64, armv6, armv7, arm64 | | `qmcgaw/private-internet-access:v3.9.0` | [v3.9.0](https://github.com/qdm12/gluetun/releases/tag/v3.9.0) | 386, amd64, armv6, armv7, arm64 | | `qmcgaw/private-internet-access:v3.8.1` | [v3.8.1](https://github.com/qdm12/gluetun/releases/tag/v3.8.1) | 386, amd64, armv6, armv7, arm64 | | `qmcgaw/private-internet-access:v3.7.0` | [v3.7.0](https://github.com/qdm12/gluetun/releases/tag/v3.7.0) | 386, amd64, armv6, armv7, arm64 | @@ -24,9 +30,3 @@ If it happens to be **broken**, this page is for you. | `qmcgaw/private-internet-access:v2` | [v2.0.0](https://github.com/qdm12/gluetun/releases/tag/v2.0.0) | 386, amd64, armv6, armv7, arm64, ppc64le, s390x | | `qmcgaw/private-internet-access:v1` | [v1](https://github.com/qdm12/gluetun/releases/tag/v1.0) | 386, amd64, armv6, armv7, arm64, ppc64le, s390x | | `qmcgaw/private-internet-access:old` | *Too old to know* | amd64 | - -[Multiple releases](https://github.com/qdm12/gluetun/releases) are made through time when the image is considered stable. - -Each time a Github release is made, an associated Docker image tag is made, for example a `v3.1.0` release produces the image `qmcgaw/gluetun:v3.1.0`. - -You can thus use one of these image tags if `:latest` doesn't work for you. Also, don't forget to [create an issue](https://github.com/qdm12/gluetun/issues/new/choose) for it πŸ˜‰ diff --git a/Setup/Environment variables.md b/Setup/Environment variables.md deleted file mode 100644 index 8cfdd7d..0000000 --- a/Setup/Environment variables.md +++ /dev/null @@ -1,350 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.environment-variables) - -**TLDR**; only set the 🏁 marked environment variables to get started. - -## VPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `VPNSP` | `private internet access` | [`custom`](#Custom), `cyberghost`, `fastestvpn`, `hidemyass`, `ivpn`, `mullvad`, `nordvpn`, `privado`, `private internet access`, `privatevpn`, `protonvpn`, `purevpn`, `surfshark`, `torguard`, `"vpn unlimited"`, `vyprvpn`, `wevpn`, `windscribe` | VPN Service Provider. πŸ’ Note this is more restricted if you use Wireguard | -| `VPN_TYPE` | `openvpn` | `openvpn` or `wireguard` | VPN type to connect to the VPN server | -| `PUBLICIP_FILE` | `/tmp/gluetun/ip` | Any filepath | Filepath to store the public IP address assigned | - -### OpenVPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `PROTOCOL` | `udp` | `udp` or `tcp` | Network protocol to use, only valid for OpenVPN | -| `OPENVPN_VERSION` | `2.5` | `2.4` or `2.5` | Set the OpenVPN version to run | -| `OPENVPN_VERBOSITY` | `1` | `0` to `6` | Openvpn verbosity level | -| `OPENVPN_FLAGS` | | Openvpn flags | Space delimited openvpn flags to pass to `openvpn` | -| `OPENVPN_ROOT` | `no` | `yes` or `no` | Run OpenVPN as root | -| `OPENVPN_TARGET_IP` | | Valid IP address | Specify a target VPN IP address to use | -| `OPENVPN_CIPHER` | | i.e. `aes-256-gcm` | Specify a custom cipher to use. It will also set `ncp-disable` if using AES GCM for PIA | -| `OPENVPN_AUTH` | | i.e. `sha256` | Specify a custom auth algorithm to use | -| `OPENVPN_IPV6` | `off` | `on`, `off` | Enable tunneling of IPv6 (only for Mullvad) | -| `OPENVPN_MSSFIX` | `0` | `0` to `9999` | Set the MSS fix parameter. Set to `0` to use the defaults. | -| `OPENVPN_INTERFACE` | `tun0` | Any interface name | Specify a custom network interface name to use | - -### Wireguard - -Note Wireguard is only supported for some VPN service providers. -More Wireguard variables are available depending on the VPN service provider. -The common Wireguard variables are described below. - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `WIREGUARD_PRESHARED_KEY` | | 32 bytes key in base64 format | Optional Wireguard pre-shared key | -| `WIREGUARD_ENDPOINT_PORT` | | `1` to `65535` | Optional Wireguard custom server endpoint port | -| `WIREGUARD_INTERFACE` | `wg0` | Any interface name | Specify a custom network interface name to use | - -## VPN service providers - -*For all providers below, server location parameters are all optional. By default a random server is picked using the filter settings provided.* - -### Mullvad - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your user ID, only required if `VPN_TYPE=openvpn` | -| `COUNTRY` | | Comma separated list of [countries](Mullvad-Servers) | VPN server country | -| `CITY` | | Comma separated list of [cities](Mullvad-Servers) | VPN server city | -| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Mullvad-Servers) | Server hostname(s) | -| `ISP` | | Comma separated list of [ISPs](Mullvad-Servers) | VPN server ISP | -| `OPENVPN_PORT` | | `80`, `443` or `1401` for TCP; `53`, `1194`, `1195`, `1196`, `1197`, `1300`, `1301`, `1302`, `1303` or `1400` for UDP. Defaults to TCP `443` and UDP `1194` | Custom VPN port to use | -| `OWNED` | `no` | `yes` or `no` | If the VPN server is owned by Mullvad. Note that `no` includes all servers | -| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| `WIREGUARD_ENDPOINT_PORT` | | Any port between `1` and `65535` | Wireguard server endpoint port to use | - -πŸ’‘ [Mullvad IPv6 Wiki page](Mullvad) - -For **port forwarding**, obtain a port from [here](https://mullvad.net/en/account/#/ports) and add it to `FIREWALL_VPN_INPUT_PORTS` - -### Cyberghost - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| 🏁 | | | **See additional setup steps below** | -| `REGION` | | Comma separated list of [Cyberghost regions](Cyberghost-Servers) | VPN server region(s) | -| `CYBERGHOST_GROUP` | | Comma separated list of [server groups](Cyberghost-Servers) | Server group(s) | -| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Cyberghost-Servers) | Server hostname(s) | - -You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key); and your Openvpn client certificate, see [Client certificate](Client-certificate) - -### FastestVPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `COUNTRY` | | Comma separated list of [FastestVPN countries](Fastestvpn-Servers) | VPN server country | -| `SERVER_HOSTNAME` | | Comma separated list of [FastestVPN hostnames](Fastestvpn-Servers) | VPN server hostname | - -### HideMyAss - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `COUNTRY` | | Comma separated list of [HideMyAss countries](HideMyAss-Servers) | VPN server country | -| `REGION` | | Comma separated list of [HideMyAss regions](HideMyAss-Servers) | VPN server region | -| `CITY` | | Comma separated list of [HideMyAss cities](HideMyAss-Servers) | VPN server city | -| `SERVER_HOSTNAME` | | Comma separated list of [HideMyAss hostnames](HideMyAss-Servers) | VPN server hostname | - -### Ivpn - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username, only required if `VPN_TYPE=openvpn` | -| 🏁 `OPENVPN_PASSWORD` | | | Your password, only required if `VPN_TYPE=openvpn` | -| `COUNTRY` | | Comma separated list of [Ivpn countries](Ivpn-Servers) | VPN server country | -| `CITY` | | Comma separated list of [Ivpn cities](Ivpn-Servers) | VPN server city | -| `ISP` | | Comma separated list of [Ivpn ISPs](Ivpn-Servers) | VPN server ISP | -| `SERVER_HOSTNAME` | | Comma separated list of [Ivpn hostnames](Ivpn-Servers) | VPN server hostname | -| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| `WIREGUARD_ENDPOINT_PORT` | | `2049`, `2050`, `53`, `30587`, `41893`, `48574`, `58237` | Wireguard server endpoint port to use | - -### NordVPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `REGION` | | Comma separated list of [NordVPN server countries](Nordvpn-servers) | VPN server country | -| `SERVER_NAME` | | | Comma separated list of [server names](Nordvpn-Servers) to choose the VPN server | -| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Nordvpn-Servers) to choose the VPN server | -| `SERVER_NUMBER` | | Comma separated list of [server numbers](Nordvpn-servers) | Optional server number. For example `251` for `Italy #251` | - -### Privado - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `REGION` | | Comma separated list of [Privado regions](Privado-Servers) | VPN server region | -| `COUNTRY` | | Comma separated list of [Privado countries](Privado-Servers) | VPN server country | -| `CITY` | | Comma separated list of [Privado cities](Privado-Servers) | VPN server city | -| `SERVER_HOSTNAME` | | Comma separated list of [hostnames](Privado-servers) | VPN server hostname | - -### Private Internet Access - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `REGION` | | Comma separated list of [regions](Private-Internet-Access-Servers) | VPN server regions | -| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](Private-Internet-Access-Servers) | Server hostname(s) | -| `SERVER_NAME` | | Comma separated list of [server names](Private-Internet-Access-Servers) | Server name(s) | -| `PIA_ENCRYPTION` | `strong` | `normal`, `strong` or `none` | Encryption preset. ⚠️ `none` disables the `cipher` and `auth` openvpn instructions | -| `OPENVPN_PORT` | | An acceptable port for PIA | Custom VPN port to use | -| `PORT_FORWARDING` | `off` | `on`, `off` | Enable port forwarding on the VPN server | -| `PORT_FORWARDING_STATUS_FILE` | `/tmp/gluetun/forwarded_port` | Any filepath | Filepath to store the forwarded port number | - -### Privatevpn - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `COUNTRY` | | Comma separated list of [Privatevpn countries](Privatevpn-Servers) | VPN server country | -| `CITY` | | Comma separated list of [Privatevpn cities](Privatevpn-Servers) | VPN server city | -| `SERVER_HOSTNAME` | | Comma separated list of [Privatevpn hostnames](Privatevpn-Servers) | VPN server hostname | - -### Protonvpn - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `COUNTRY` | | | Comma separated list of [countries](Protonvpn-Servers) to choose the VPN server | -| `REGION` | | | Comma separated list of [regions](Protonvpn-Servers) to choose the VPN server | -| `CITY` | | | Comma separated list of [cities](Protonvpn-Servers) to choose the VPN server | -| `SERVER_NAME` | | | Comma separated list of [server names](Protonvpn-Servers) to choose the VPN server | -| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Protonvpn-Servers) to choose the VPN server | -| `OPENVPN_PORT` | `1194` for UDP and `443` for TCP | For TCP: `443`, `5995` or `8443`; for UDP: `80`, `443`, `1194`, `4569`, `5060` | Custom VPN port to use | -| `FREE_ONLY` | `off` | `on` or `off` | Only use free tier servers | - -### PureVPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `REGION` | | Comma separated list of [PureVPN regions](Purevpn-Servers) | VPN server region | -| `COUNTRY` | | Comma separated list of [PureVPN countries](Purevpn-Servers) | VPN server country | -| `CITY` | | Comma separated list of [PureVPN cities](Purevpn-Servers) | VPN server city | -| `SERVER_HOSTNAME` | | Comma separated list of [hostnames](Purevpn-servers) | VPN server hostname | - -### Surfshark - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your **service** username, found at the bottom of the [manual setup page](https://account.surfshark.com/setup/manual) | -| 🏁 `OPENVPN_PASSWORD` | | | Your **service** password | -| `REGION` | | Comma separated list of [Surfshark regions](Surfshark-Servers) | VPN server region | -| `SERVER_HOSTNAME` | | Comma separated list of [Surfshark hostnames](Surfshark-Servers) to choose the VPN server | VPN server hostname | - -### Torguard - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `COUNTRY` | | Comma separated list of [Torguard countries](Torguard-Servers) | VPN server country | -| `CITY` | | Comma separated list of [Torguard cities](Torguard-Servers) | VPN server city, if any | -| `SERVER_HOSTNAME` | | Comma separated list of [Torguard hostnames](Torguard-Servers) | VPN server hostname | - -- πŸ’ To use Wireguard, use the [Custom provider](#Custom) - -### VPN Unlimited (KeepSolid) - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 | | | **See additional setup steps below** | -| `COUNTRY` | | | Comma separated list of [countries](VPN-Unlimited-Servers) to choose the VPN server | -| `REGION` | | | Comma separated list of [regions](VPN-Unlimited-Servers) to choose the VPN server | -| `CITY` | | | Comma separated list of [cities](VPN-Unlimited-Servers) to choose the VPN server | -| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](VPN-Unlimited-Servers) to choose the VPN server | - -- ⚠️ You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key); and your Openvpn client certificate, see [Client certificate](Client-certificate) -- πŸ’ To use Wireguard, use the [Custom provider](#Custom) - -### Vyprvpn - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| `REGION` | | Comma separated list of [VyprVPN regions](Vyprvpn-Servers) | VPN server region(s) | -| `SERVER_HOSTNAME` | | Comma separated list of [VyprVPN hostnames](Vyprvpn-Servers) | VPN server hostname(s) | - -πŸ’‘ [VPN port forwarding](Port-forwarding#VyprVPN) - -### WeVPN - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username | -| 🏁 `OPENVPN_PASSWORD` | | | Your password | -| 🏁 | | | **See additional setup steps below** | -| `CITY` | | Comma separated list of [WeVPN cities](WeVPN-Servers) | VPN server city(ies) | -| `SERVER_HOSTNAME` | | Comma separated list of [server hostnames](WeVPN-Servers) | Server hostname(s) | -| `PORT` | | For `tcp`: `53`, `1195`, `1199`, `2018`; for `udp`: `80`, `1194`, `1198` | Custom VPN port to use | - -- ⚠️ You need to have your Openvpn private key file accessible to Gluetun, see [Client key](Client-key). -- πŸ’ To use Wireguard, use the [Custom provider](#Custom) - -### Windscribe - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_USER` | | | Your username (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)), only required if `VPN_TYPE=openvpn` | -| 🏁 `OPENVPN_PASSWORD` | | | Your password (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)), only required if `VPN_TYPE=openvpn` | -| `REGION` | | | Comma separated list of [regions](Windscribe-Servers) to choose the VPN server | -| `CITY` | | | Comma separated list of [cities](Windscribe-Servers) to choose the VPN server | -| `SERVER_HOSTNAME` | | | Comma separated list of [hostnames](Windscribe-Servers) to choose the VPN server | -| `OPENVPN_PORT` | | One from the [this list of ports](https://windscribe.com/getconfig/openvpn) | Custom VPN port to use | -| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address, only required if `VPN_TYPE=wireguard`. Note this is usually specific by user and the same for all servers. | -| `WIREGUARD_ENDPOINT_PORT` | | `53`, `80`, `123`, `443`, `1194`, `65142` | Wireguard server endpoint port to use | - -### Custom - -The `custom` VPN 'service provider' is to support [custom configuration files for OpenVPN](Openvpn-file) and -custom configurations for Wireguard. - -The following variables are available for OpenVPN (only if `VPNTYPE=openvpn`): - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `OPENVPN_CUSTOM_CONFIG` | | File path | The path to your OpenVPN configuration file | - -On top of the existing [Wireguard variables](#Wireguard), the following variables are available for Wireguard (only if `VPNTYPE=wireguard`): - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| 🏁 `WIREGUARD_ENDPOINT_IP` | | Endpoint IP address | The server endpoint IP address | -| 🏁 `WIREGUARD_ENDPOINT_PORT` | | Endpoint port | The server endpoint port, usually `51820` | -| 🏁 `WIREGUARD_PUBLIC_KEY` | | Wireguard public key | The server public key | -| 🏁 `WIREGUARD_PRIVATE_KEY` | | 32 bytes key in base64 format | Wireguard private key | -| 🏁 `WIREGUARD_ADDRESS` | | IP network in the format `xx.xx.xx.xx/xx` | Wireguard interface address | - -## DNS over TLS - -None of the following values are required. - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `DOT` | `on` | `on`, `off` | Activate DNS over TLS with Unbound | -| `DOT_PROVIDERS` | `cloudflare` | `cloudflare`, `google`, `quad9`, `quadrant`, `cleanbrowsing` | Comma delimited list of DNS over TLS providers | -| `DOT_CACHING` | `on` | `on`, `off` | Unbound caching | -| `DOT_IPV6` | `off` | `on`, `off` | DNS IPv6 resolution | -| `DOT_PRIVATE_ADDRESS` | All private CIDRs ranges | | Comma separated list of CIDRs or single IP addresses Unbound won't resolve to. Note that the default setting prevents DNS rebinding | -| `DOT_VERBOSITY` | `1` | `0` to `5` | Unbound verbosity level | -| `DOT_VERBOSITY_DETAILS` | `0` | `0` to `4` | Unbound details verbosity level | -| `DOT_VALIDATION_LOGLEVEL` | `0` | `0` to `2` | Unbound validation log level | -| `DNS_UPDATE_PERIOD` | `24h` | i.e. `0`, `30s`, `5m`, `24h` | Period to update block lists and cryptographic files and restart Unbound. Set to `0` to deactivate updates | -| `BLOCK_MALICIOUS` | `on` | `on`, `off` | Block malicious hostnames and IPs with Unbound | -| `BLOCK_SURVEILLANCE` | `off` | `on`, `off` | Block surveillance hostnames and IPs with Unbound | -| `BLOCK_ADS` | `off` | `on`, `off` | Block ads hostnames and IPs with Unbound | -| `UNBLOCK` | |i.e. `domain1.com,x.domain2.co.uk` | Comma separated list of domain names to leave unblocked with Unbound | -| `DNS_PLAINTEXT_ADDRESS` | `1.1.1.1` | Any IP address | IP address to use as DNS resolver if `DOT` is `off` | -| `DNS_KEEP_NAMESERVER` | `off` | `on` or `off` | Keep the nameservers in /etc/resolv.conf untouched, but disabled DNS blocking features | - -## Firewall and routing - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `FIREWALL` | `on` | `on` or `off` | Turn on or off the container built-in firewall. You should use it for **debugging purposes** only. | -| `FIREWALL_VPN_INPUT_PORTS` | | i.e. `1000,8080` | Comma separated list of ports to allow from the VPN server side (useful for **vyprvpn** port forwarding) | -| `FIREWALL_INPUT_PORTS` | | i.e. `1000,8000` | Comma separated list of ports to allow through the default interface. This seems needed for Kubernetes sidecars. | -| `FIREWALL_DEBUG` | `off` | `on` or `off` | Prints every firewall related command. You should use it for **debugging purposes** only. | -| `FIREWALL_OUTBOUND_SUBNETS` | | i.e. `192.168.1.0/24,192.168.10.121,10.0.0.5/28` | Comma separated subnets that Gluetun and the containers sharing its network stack are allowed to access. This involves firewall and routing modifications. | - -## Shadowsocks - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `SHADOWSOCKS` | `off` | `on`, `off` | Enable the internal Shadowsocks proxy | -| `SHADOWSOCKS_LOG` | `off` | `on`, `off` | Enable logging | -| `SHADOWSOCKS_ADDRESS` | `:8388` | Listening address | Internal listening address for Shadowsocks | -| `SHADOWSOCKS_PASSWORD` | | | Password to use to connect to Shadowsocks | -| `SHADOWSOCKS_CIPHER` | `chacha20-ietf-poly1305` | `chacha20-ietf-poly1305`, `aes-128-gcm`, `aes-256-gcm` | AEAD Cipher to use for Shadowsocks | - -## HTTP proxy - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `HTTPPROXY` | `off` | `on`, `off` | Enable the internal HTTP proxy | -| `HTTPPROXY_LOG` | `off` | `on` or `off` | Logs every tunnel requests | -| `HTTPPROXY_PORT` | `8888` | `1024` to `65535` | Internal port number for the HTTP proxy to listen on | -| `HTTPPROXY_USER` | | | Username to use to connect to the HTTP proxy | -| `HTTPPROXY_PASSWORD` | | | Password to use to connect to the HTTP proxy | -| `HTTPPROXY_STEALTH` | `off` | `on` or `off` | Stealth mode means HTTP proxy headers are not added to your requests | - -## System - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `TZ` | | i.e. `Europe/London` | Specify a timezone to use to have correct log times | -| `PUID` | `1000` | | User ID to run as non root and for ownership of files written | -| `PGID` | `1000` | | Group ID to run as non root and for ownership of files written | - -## HTTP Control server - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `HTTP_CONTROL_SERVER_PORT` | `8000` | `1` to `65535` | Listening port for the HTTP control server | -| `HTTP_CONTROL_SERVER_LOG` | `on` | `on` or `off` | Enable logging of HTTP requests | - -## Other - -| Variable | Default | Choices | Description | -| --- | --- | --- | --- | -| `PUBLICIP_PERIOD` | `12h` | Valid duration | Period to check for public IP address. Set to `0` to disable. | -| `VERSION_INFORMATION` | `on` | `on`, `off` | Logs a message indicating if a newer version is available once the VPN is connected | -| `UPDATER_PERIOD` | `0` | Valid duration string such as `24h` | Period to update all VPN servers information in memory and to /gluetun/servers.json. Set to `0` to disable. This does a burst of DNS over TLS requests, which may be blocked if you set `BLOCK_MALICIOUS=on` for example. | diff --git a/Setup/OpenVPN client certificate.md b/Setup/OpenVPN client certificate.md new file mode 100644 index 0000000..a397658 --- /dev/null +++ b/Setup/OpenVPN client certificate.md @@ -0,0 +1,21 @@ +![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-certificate) + +πŸ›‘ These instructions are only for specific VPN providers, such as Cyberghost. You should not read this if it not mentioned. + +Your client certificate is usually of the form: + +```pem +-----BEGIN CERTIFICATE----- +... +... +-----END CERTIFICATE----- +``` + +It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider. + +First, you need to take your client certificat (from its start line `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`) and place it in a file on your host that we name `client.crt` + +The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can: + +1. Move `client.crt` to `/yourpath/gluetun/client.crt` on your host +1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun` diff --git a/Setup/OpenVPN client key.md b/Setup/OpenVPN client key.md new file mode 100644 index 0000000..00bf794 --- /dev/null +++ b/Setup/OpenVPN client key.md @@ -0,0 +1,21 @@ +![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.client-key) + +πŸ›‘ These instructions are only for specific VPN providers, such as Cyberghost and VPN Unlimited. You should not read this if it not mentioned. + +Your client key is usually of the form: + +```pem +-----BEGIN PRIVATE KEY----- +... +... +-----END PRIVATE KEY----- +``` + +It may be given to you as a separate file or inlined in your Openvpn configuration file by your VPN service provider. + +First, you need to take your key (from its start line `-----BEGIN PRIVATE KEY-----` to `-----END PRIVATE KEY-----`) and place it in a file on your host that we name `client.key`. + +The easiest path is to bind mount it in gluetun in the `/gluetun` directory, so you can: + +1. Move `client.key` to `/yourpath/gluetun/client.key` on your host +1. Run gluetun bind mounting `-v /yourpath/gluetun:/gluetun` diff --git a/Setup/Port forwarding.md b/Setup/Port forwarding.md deleted file mode 100644 index 6c14293..0000000 --- a/Setup/Port forwarding.md +++ /dev/null @@ -1,77 +0,0 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.port-forwarding) - -⚠️ This is about VPN server side port forwarding and not port publishing for your Gluetun setup using Docker. If you are looking for port publishing, check [this page](Port-mapping) out. - -## Providers - -⚠️ not all VPN providers support VPN server side port forwarding. - -### Private Internet Access - -⚠️ port forwarding with PIA is not really working for some reason. This is not a gluetun issue, but a PIA one. It seems to only work for port forwarding for torrenting applications, not sure why, maybe they run deep packet inspection on the forwarded port. - -When `PORT_FORWARDING=on`, a port will be forwarded on the VPN server side and written to the file specified by `PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port`. - -It can be useful to mount this file as a volume to read it from other containers, for example to configure a torrenting client. - -You will keep the same forwarded port for 60 days as long as you bind mount the `/gluetun` directory. - -You can also use the [HTTP control server](HTTP-Control-server#OpenVPN) to get the port forwarded. - -### VyprVPN - -By default, VyprVPN does not forward any port. - -You need to disable the NAT firewall in the Manage services section of your account at [account.vyprvpn.com](https://account.vyprvpn.com/) ([source](https://support.vyprvpn.com/hc/en-us/articles/360039668472-Does-VyprVPN-support-Port-Forwarding-)). - -All the ports will then be forwarded to you, so it's like you are running alone on the VPN server. - -Therefore, you only need to allow these ports through the gluetun firewall by setting the ports you need in `FIREWALL_VPN_INPUT_PORTS`. -For example `FIREWALL_VPN_INPUT_PORTS=8000,9000`. - -### Windscribe - -1. Follow the [Windscribe instructions](https://windscribe.com/support/article/37/what-is-ephemeral-port-forwarding-and-how-to-use-it) -1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, e.g. `FIREWALL_VPN_INPUT_PORTS=8099` -1. Start/Restart the container and it should be ready - -### Mullvad - -1. Assign a port to be forwarded through their web user interface -1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, e.g. `FIREWALL_VPN_INPUT_PORTS=8099` -1. Start/Restart the container and it should be ready - -### Other - -I am not aware, feel free to create a Github issue or discussion so I can document it here! - -## Deluge - -[@jawilson](https://github.com/jawilson) developed a plugin to automagically update the forwarded port in Deluge: [**deluge-piaportplugin**](https://github.com/jawilson/deluge-piaportplugin) - -Feel free to thank him on his repository πŸ‘ - -## Test it - -Assuming: - -- your gluetun container name is `gluetun` -- your VPN public IP address is `99.99.99.99` -- your VPN port forwarded is `8888` - -You can test it with: - -```sh -docker exec -it gluetun /bin/sh -# Change amd64 to your CPU architecture -wget -qO port-checker https://github.com/qdm12/port-checker/releases/download/v0.3.0/port-checker_0.3.0_linux_amd64 -chmod +x port-checker -./port-checker -port 8888 -``` - -Then in your browser, access [http://99.99.99.99:8888](http://99.99.99.99:8888). - -It should show you your browser IP address and user agent. -You should also see the request logged in the port-checker output. - -Finally, back to the terminal, press `CTRL+C` to stop port-checker and enter `exit` to quit the interactive shell in `gluetun`. diff --git a/Setup/32 bit setup.md b/Setup/Prerequisites/32 bit prerequisites.md similarity index 100% rename from Setup/32 bit setup.md rename to Setup/Prerequisites/32 bit prerequisites.md diff --git a/Setup/Synology setup.md b/Setup/Prerequisites/Synology prerequisites.md similarity index 100% rename from Setup/Synology setup.md rename to Setup/Prerequisites/Synology prerequisites.md diff --git a/Setup/Providers/Custom provider.md b/Setup/Providers/Custom provider.md new file mode 100644 index 0000000..1b712e1 --- /dev/null +++ b/Setup/Providers/Custom provider.md @@ -0,0 +1,66 @@ +## TLDR + +```sh +# OpenVPN +docker run -it --rm --cap-add=NET_ADMIN \ +-e VPNSP=custom -e VPN_TYPE=openvpn \ +-v /yourpath/yourconfig.conf:/gluetun/config.conf \ +-e OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf:ro \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc qmcgaw/gluetun +``` + +πŸ’ See the [Openvpn configuration file page]((Openvpn-configuration-file)) for information on how to set this up. + +```sh +# Wireguard +docker run -it --rm --cap-add=NET_ADMIN \ +-e VPNSP=custom -e VPN_TYPE=wireguard \ +-e WIREGUARD_ENDPOINT_IP=1.2.3.4 \ +-e WIREGUARD_ENDPOINT_PORT=51820 \ +-e WIREGUARD_PUBLIC_KEY=wAUaJMhAq3NFutLHIdF8AN0B5WG8RndfQKLPTEDHal0= \ +-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \ +-e WIREGUARD_PRESHARED_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \ +-e WIREGUARD_ADDRESS="10.64.222.21/32" \ +qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + volumes: + - ./yourovpnconfig.conf:/gluetun/config.conf:ro + environment: + - VPNSP=custom + - VPN_TYPE=wireguard + + # For OpenVPN + #- OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf + + # For Wireguard + - WIREGUARD_ENDPOINT_IP=1.2.3.4 + - WIREGUARD_ENDPOINT_PORT=51820 + - WIREGUARD_PUBLIC_KEY=wAUaJMhAq3NFutLHIdF8AN0B5WG8RndfQKLPTEDHal0= + - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= + - WIREGUARD_PRESHARED_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= + - WIREGUARD_ADDRESS=10.64.222.21/32 +``` + +## Required environment variables + +- `VPNSP=custom` + +### OpenVPN only + +- `OPENVPN_CUSTOM_CONFIG`: Path to your custom configuration file. + +### Wireguard only + +- `WIREGUARD_ENDPOINT_IP`: the server endpoint IP address +- `WIREGUARD_ENDPOINT_PORT`: the server endpoint port +- `WIREGUARD_PUBLIC_KEY` is the server 32 bytes public key in base64 format. +- `WIREGUARD_PRIVATE_KEY` is your 32 bytes private key in base64 format. +- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. diff --git a/Servers/Cyberghost Servers.md b/Setup/Providers/Cyberghost.md similarity index 88% rename from Servers/Cyberghost Servers.md rename to Setup/Providers/Cyberghost.md index 0ceb5d2..09e23de 100644 --- a/Servers/Cyberghost Servers.md +++ b/Setup/Providers/Cyberghost.md @@ -1,8 +1,46 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.cyberghost) +## TLDR -## Servers available +1. Follow the steps here: [Client key](Client-key) +1. Follow the steps here: [Client certificate](Client-certificate) -The list of servers for Cyberghost is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=cyberghost \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-v /yourpath:/gluetun \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=cyberghost + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - REGION=Netherlands + volumes: + ./gluetun:/gluetun +``` + +## Required environment variables + +- `VPNSP=cyberghost` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `CYBERGHOST_GROUP`: Comma separated list of [groups](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Group | Hostname | | --- | --- | --- | diff --git a/Servers/Fastestvpn Servers.md b/Setup/Providers/FastestVPN.md similarity index 84% rename from Servers/Fastestvpn Servers.md rename to Setup/Providers/FastestVPN.md index 6de46f8..db8875c 100644 --- a/Servers/Fastestvpn Servers.md +++ b/Setup/Providers/FastestVPN.md @@ -1,6 +1,39 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.fastestvpn) +## TLDR -The list of servers for FastestVPN is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=fastestvpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=fastestvpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=fastestvpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Hostname | UDP | TCP | | --- | --- | --- | --- | @@ -82,4 +115,4 @@ The list of servers for FastestVPN is shown below: | US-St.Louis | us-st3.jumptoserver.com | [x] | [x] | | US-St.Louis | us-st4.jumptoserver.com | [x] | [x] | | US-St.Louis | us-st5.jumptoserver.com | [x] | [x] | -| US-Washington | us-wt.jumptoserver.com | [x] | [x] | \ No newline at end of file +| US-Washington | us-wt.jumptoserver.com | [x] | [x] | diff --git a/Servers/HideMyAss Servers.md b/Setup/Providers/Hidemyass.md similarity index 94% rename from Servers/HideMyAss Servers.md rename to Setup/Providers/Hidemyass.md index e2301d3..45def80 100644 --- a/Servers/HideMyAss Servers.md +++ b/Setup/Providers/Hidemyass.md @@ -1,6 +1,41 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.hidemyass) +## TLDR -The list of servers for Mullvad is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=hidemyass \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=hidemyass + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=hidemyass` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Region | City | Hostname | TCP | UDP | | --- | --- | --- | --- | --- | --- | diff --git a/Setup/Providers/IVPN.md b/Setup/Providers/IVPN.md new file mode 100644 index 0000000..7df2207 --- /dev/null +++ b/Setup/Providers/IVPN.md @@ -0,0 +1,135 @@ +## TLDR + +```sh +# OpenVPN +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=ivpn \ +-e VPN_TYPE=openvpn -e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e CITY=amsterdam qmcgaw/gluetun +``` + +```sh +# Wireguard +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=ivpn \ +-e VPN_TYPE=wireguard \ +-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \ +-e WIREGUARD_ADDRESS="10.64.222.21/32" \ +-e CITY=amsterdam qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=ivpn + - VPN_TYPE=wireguard + - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= + - WIREGUARD_ADDRESS=10.64.222.21/32 + - CITY=Amsterdam +``` + +## Required environment variables + +- `VPNSP=ivpn` + +### OpenVPN only + +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +### Wireguard only + +- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers. +- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers. + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `ISP`: Comma separated list of [ISPs](#Servers) +- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use, which can be one of: `2049`, `2050`, `53`, `30587`, `41893`, `48574`, `58237` + +## VPN Port forwarding + +1. Log in your Mullvad account at [https://ivpn.net/en/account](https://ivpn.net/en/account) +1. Obtain a port from [https://ivpn.net/en/account/#/ports](https://ivpn.net/en/account/#/ports) +1. Add the port to the environment variable `FIREWALL_VPN_INPUT_PORTS` + +## IPv6 tunneling with OpenVPN + +By default, IPv6 is just blocked by the firewall in gluetun. + +If you want to tunnel IPv6 with Mullvad using OpenVPN: + +1. Ensure your Kernel has IPv6 + + ```sh + lsmod | grep ipv6 + ``` + + Should show something. +1. Set the environment variable `OPENVPN_IPV6` to `on` +1. Enable IPv6 in Docker for this container: + - For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems) + - For docker-compose.yml files, add this to your `gluetun` config block: + + ```yml + sysctls: + - net.ipv6.conf.all.disable_ipv6=0 + ``` + +1. Start the container + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) + +| Country | City | Hostname | +| --- | --- | --- | +| Australia | | `au-nsw.gw.ivpn.net` | +| Austria | | `at.gw.ivpn.net` | +| Belgium | | `be.gw.ivpn.net` | +| Brazil | | `br.gw.ivpn.net` | +| Canada | Montreal | `ca-qc.gw.ivpn.net` | +| Canada | Toronto | `ca.gw.ivpn.net` | +| Czech Republic | | `cz.gw.ivpn.net` | +| Denmark | | `dk.gw.ivpn.net` | +| Finland | | `fi.gw.ivpn.net` | +| France | | `fr.gw.ivpn.net` | +| Germany | | `de.gw.ivpn.net` | +| Hong Kong | | `hk.gw.ivpn.net` | +| Hungary | | `hu.gw.ivpn.net` | +| Iceland | | `is.gw.ivpn.net` | +| Israel | | `il.gw.ivpn.net` | +| Italy | | `it.gw.ivpn.net` | +| Japan | | `jp.gw.ivpn.net` | +| Luxembourg | | `lu.gw.ivpn.net` | +| Netherlands | | `nl.gw.ivpn.net` | +| Norway | | `no.gw.ivpn.net` | +| Poland | | `pl.gw.ivpn.net` | +| Portugal | | `pt.gw.ivpn.net` | +| Romania | | `ro.gw.ivpn.net` | +| Serbia | | `rs.gw.ivpn.net` | +| Singapore | | `sg.gw.ivpn.net` | +| Slovakia | | `sk.gw.ivpn.net` | +| Sweden | | `se.gw.ivpn.net` | +| Switzerland | | `ch.gw.ivpn.net` | +| USA | Atlanta | `us-ga.gw.ivpn.net` | +| USA | Chicago | `us-il.gw.ivpn.net` | +| USA | Dallas | `us-tx.gw.ivpn.net` | +| USA | Las Vegas | `us-nv.gw.ivpn.net` | +| USA | Los Angeles | `us-ca.gw.ivpn.net` | +| USA | Miami | `us-fl.gw.ivpn.net` | +| USA | New Jersey | `us-nj.gw.ivpn.net` | +| USA | New York | `us-ny.gw.ivpn.net` | +| USA | Phoenix | `us-az.gw.ivpn.net` | +| USA | Salt Lake City | `us-ut.gw.ivpn.net` | +| USA | Seattle | `us-wa.gw.ivpn.net` | +| USA | Washington | `us-dc.gw.ivpn.net` | +| Ukraine | | `ua.gw.ivpn.net` | +| United Kingdom | London | `gb.gw.ivpn.net` | +| United Kingdom | Manchester | `gb-man.gw.ivpn.net` | diff --git a/Servers/Mullvad Servers.md b/Setup/Providers/Mullvad.md similarity index 84% rename from Servers/Mullvad Servers.md rename to Setup/Providers/Mullvad.md index f09bb88..c84268e 100644 --- a/Servers/Mullvad Servers.md +++ b/Setup/Providers/Mullvad.md @@ -1,6 +1,96 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.mullvad) +## TLDR -The list of servers for Mullvad is shown below: +```sh +# OpenVPN +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=mullvad \ +-e VPN_TYPE=openvpn -e OPENVPN_USER=1355131650462193 \ +-e CITY=amsterdam qmcgaw/gluetun +``` + +```sh +# Wireguard +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=mullvad \ +-e VPN_TYPE=wireguard \ +-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \ +-e WIREGUARD_ADDRESS="10.64.222.21/32" \ +-e CITY=amsterdam qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=mullvad + - VPN_TYPE=wireguard + - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= + - WIREGUARD_ADDRESS=10.64.222.21/32 + - CITY=Amsterdam +``` + +## Required environment variables + +- `VPNSP=mullvad` + +### OpenVPN only + +- `OPENVPN_USER` which is your Mullvad user ID. + +### Wireguard only + +- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers. +- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers. + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `ISP`: Comma separated list of [ISPs](#Servers) +- `OWNED`: If the VPN server is owned by Mullvad. It defaults to `no`, meaning it includes all servers. It can be set to `yes`. | +- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use + - For TCP: `80`, `443` or `1401` + - For UDP: `53`, `1194`, `1195`, `1196`, `1197`, `1300`, `1301`, `1302`, `1303` or `1400` + - It defaults to `443` for TCP and `1194` for UDP +- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use + +## VPN Port forwarding + +1. Log in your Mullvad account at [https://mullvad.net/en/account](https://mullvad.net/en/account) +1. Obtain a port from [https://mullvad.net/en/account/#/ports](https://mullvad.net/en/account/#/ports) +1. Add the port to the environment variable `FIREWALL_VPN_INPUT_PORTS` + +## IPv6 tunneling with OpenVPN + +By default, IPv6 is just blocked by the firewall in gluetun. + +If you want to tunnel IPv6 with Mullvad using OpenVPN: + +1. Ensure your Kernel has IPv6 + + ```sh + lsmod | grep ipv6 + ``` + + Should show something. +1. Set the environment variable `OPENVPN_IPV6` to `on` +1. Enable IPv6 in Docker for this container: + - For a Docker run command, add the flag `--sysctl net.ipv6.conf.all.disable_ipv6=0` (or `--sysctl net.ipv6.conf.all.disable=0` on some systems) + - For docker-compose.yml files, add this to your `gluetun` config block: + + ```yml + sysctls: + - net.ipv6.conf.all.disable_ipv6=0 + ``` + +1. Start the container + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | City | Hostname | ISP | Owned | | --- | --- | --- | --- | --- | diff --git a/Setup/Providers/NordVPN.md b/Setup/Providers/NordVPN.md new file mode 100644 index 0000000..0dd0619 --- /dev/null +++ b/Setup/Providers/NordVPN.md @@ -0,0 +1,40 @@ +## TLDR + +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=nordvpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=nordvpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - REGION=Netherlands +``` + +## Required environment variables + +- `VPNSP=nordvpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `SERVER_NAME`: Comma separated list of [server names](#Servers) +- `SERVER_NUMBER`: Comma separated list of [server numbers](#Servers). For example `251` for `Italy #251` | + +## Servers + +The list of servers for NordVPN is available in the [source code](https://github.com/qdm12/gluetun/blob/master/internal/storage/servers.json). + +The table of servers cannot be put here unfortunately as there are too many servers and the Github markdown engine then fails. diff --git a/Servers/Privado Servers.md b/Setup/Providers/Privado.md similarity index 96% rename from Servers/Privado Servers.md rename to Setup/Providers/Privado.md index b3a6017..4f057be 100644 --- a/Servers/Privado Servers.md +++ b/Setup/Providers/Privado.md @@ -1,6 +1,41 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.privado) +## TLDR -The list of servers for Privado is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=privado \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=privado + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=privado` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Region | City | Hostname | | --- | --- | --- | --- | diff --git a/Servers/Private Internet Access Servers.md b/Setup/Providers/Private internet access.md similarity index 91% rename from Servers/Private Internet Access Servers.md rename to Setup/Providers/Private internet access.md index 23bbb54..e264cae 100644 --- a/Servers/Private Internet Access Servers.md +++ b/Setup/Providers/Private internet access.md @@ -1,6 +1,59 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.pia) +## TLDR -The list of servers for Private Internet Access is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP="private internet access" \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-v gluetun:/gluetun \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + volumes: + - gluetun:/gluetun + environment: + - VPNSP=private internet access + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - REGION=Netherlands +``` + +## Required environment variables + +- `VPNSP=private internet access` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `SERVER_NAME`: Comma separated list of [server names](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `PIA_ENCRYPTION`: Encryption preset, defaulting to `strong`, which can be set to `normal`, `strong` or `none`. ⚠️ `none` disables the `cipher` and `auth` OpenVPN options. +- `OPENVPN_PORT`: Custom OpenVPN server endpoint port +- `PORT_FORWARDING`: defaults to `off` and can be set to `on`to enable port forwarding on the VPN server +- `PORT_FORWARDING_STATUS_FILE`: File path to write the forwarded port number to. It defaults to `/tmp/gluetun/forwarded_port`. + +## VPN server port forwarding + +⚠️ port forwarding with PIA is not really working for some reason. This is not a gluetun issue, but a PIA one. It seems to only work for port forwarding for torrenting applications, not sure why, maybe they run deep packet inspection on the forwarded port. + +When `PORT_FORWARDING=on`, a port will be forwarded on the VPN server side and written to the file specified by `PORT_FORWARDING_STATUS_FILE=/tmp/gluetun/forwarded_port`. + +It can be useful to mount this file as a volume to read it from other containers, for example to configure a torrenting client. + +You will keep the same forwarded port for 60 days as long as you bind mount the `/gluetun` directory. + +You can also use the [HTTP control server](HTTP-Control-server#OpenVPN) to get the port forwarded. + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Region | Hostname | Server name | TCP | UDP | Port forwarding available | | --- | --- | --- | --- | --- | --- | diff --git a/Servers/Privatevpn Servers.md b/Setup/Providers/PrivateVPN.md similarity index 80% rename from Servers/Privatevpn Servers.md rename to Setup/Providers/PrivateVPN.md index 10e5724..c6a73ff 100644 --- a/Servers/Privatevpn Servers.md +++ b/Setup/Providers/PrivateVPN.md @@ -1,6 +1,40 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.privatevpn) +## TLDR -The list of servers for PrivateVPN is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=privatevpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=privatevpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=privatevpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | City | Hostname | | --- | --- | --- | diff --git a/Servers/Protonvpn Servers.md b/Setup/Providers/ProtonVPN.md similarity index 98% rename from Servers/Protonvpn Servers.md rename to Setup/Providers/ProtonVPN.md index 68e3408..7264961 100644 --- a/Servers/Protonvpn Servers.md +++ b/Setup/Providers/ProtonVPN.md @@ -1,11 +1,53 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.protonvpn) +## TLDR -## Regions available +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=protonvpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` -Note 1: the container uses information extracted from [ProtonVPN's API](https://api.protonmail.ch/vpn/logicals) which may change over time, making this table outdated. -Note 2: Every country, region and city are **exit** locations and not entry +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=protonvpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` -The list of servers for Protonvpn is shown below: +## Required environment variables + +- `VPNSP=protonvpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_NAME`: Comma separated list of [server names](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `FREE_ONLY`: Filter only free tier servers by setting it to `on`. It defaults to `off`. +- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use + - For TCP: `443`, `5995` or `8443` + - For UDP: `80`, `443`, `1194`, `4569`, `5060` + - Defaults are `1194` for UDP and `443` for TCP + +## Multi hop regions + +Simply set the `SERVER_NAME` or `SERVER_HOSTNAME` environment variable to a hostname corresponding to a multi hop region (see [Servers](#Servers)). + +For example setting `SERVER_NAME=CH-US#1` or setting `SERVER_HOSTNAME=ch-us-01a.protonvpn.com` would set a multi hop with entry in Switzerland and exit in the US. + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Region | City | Server name | Server hostname | | --- | --- | --- | --- | --- | @@ -1579,9 +1621,3 @@ The list of servers for Protonvpn is shown below: | United States | West | San Jose | US-CA#2 | us-ca-02.protonvpn.com | | United States | West | San Jose | US-CA#3 | us-ca-03.protonvpn.com | | United States | West | San Jose | US-CA#4 | us-ca-04.protonvpn.com | - -## Multi hop regions - -Simply set the `SERVER_NAME` or `SERVER_HOSTNAME` environment variable to a hostname corresponding to a multi hop region. - -For example setting `SERVER_NAME=CH-US#1` or setting `SERVER_HOSTNAME=ch-us-01a.protonvpn.com` would set a multi hop with entry in Switzerland and exit in the US. diff --git a/Servers/Purevpn Servers.md b/Setup/Providers/PureVPN.md similarity index 90% rename from Servers/Purevpn Servers.md rename to Setup/Providers/PureVPN.md index 743c8b6..db7af39 100644 --- a/Servers/Purevpn Servers.md +++ b/Setup/Providers/PureVPN.md @@ -1,6 +1,41 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.purevpn) +## TLDR -The list of servers for PureVPN is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=purevpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=purevpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=purevpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Region | City | Hostname | TCP | UDP | | --- | --- | --- | --- | --- | --- | diff --git a/Servers/Surfshark Servers.md b/Setup/Providers/Surfshark.md similarity index 91% rename from Servers/Surfshark Servers.md rename to Setup/Providers/Surfshark.md index 4091d2f..2cf6f6a 100644 --- a/Servers/Surfshark Servers.md +++ b/Setup/Providers/Surfshark.md @@ -1,6 +1,56 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.surfshark) +## TLDR -The list of servers for Surfshark is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=surfshark \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=surfshark + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - REGION=Netherlands +``` + +## Required environment variables + +- `VPNSP=surfshark` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Multi hop regions + +Simply set the `REGION` environment variable using one of the following: + +- Australia US +- Canada US +- Germany Singapour +- Germany UK +- France Sweden +- India UK +- Netherlands US +- Singapore Hong Kong +- UK Germany +- UK France +- US Netherlands +- US Portugal + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Region | Hostname | | --- | --- | @@ -163,23 +213,3 @@ The list of servers for Surfshark is shown below: | Ukraine | `ua-iev.prod.surfshark.com` | | United Arab Emirates | `ae-dub.prod.surfshark.com` | | Vietnam | `vn-hcm.prod.surfshark.com` | - -Note 1: the container uses information extracted from [openvpn files downloaded from Surfshark](https://account.surfshark.com/api/v1/server/configurations), so there is more regions available than from the website. -Note 2: Regions with `st00x` suffixes means they have a corresponding single static IP address. You might want to use these if you want to always have the same IP address. - -## Multi hop regions - -Simply set the `REGION` environment variable using one of the following: - -- Australia US -- Canada US -- Germany Singapour -- Germany UK -- France Sweden -- India UK -- Netherlands US -- Singapore Hong Kong -- UK Germany -- UK France -- US Netherlands -- US Portugal diff --git a/Servers/Torguard Servers.md b/Setup/Providers/Torguard.md similarity index 73% rename from Servers/Torguard Servers.md rename to Setup/Providers/Torguard.md index d2bde35..729b1d6 100644 --- a/Servers/Torguard Servers.md +++ b/Setup/Providers/Torguard.md @@ -1,6 +1,42 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.torguard) +## TLDR -The list of servers for Torguard is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=torguard \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=torguard + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +πŸ’ To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup). + +## Required environment variables + +- `VPNSP=torguard` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | City | Hostname | | --- | --- | --- | diff --git a/Setup/Providers/VPN Unlimited.md b/Setup/Providers/VPN Unlimited.md new file mode 100644 index 0000000..a020ee1 --- /dev/null +++ b/Setup/Providers/VPN Unlimited.md @@ -0,0 +1,102 @@ +## TLDR + +πŸ’ To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup). + +For OpenVPN: + +1. Follow the steps here: [Client key](Client-key) +1. Follow the steps here: [Client certificate](Client-certificate) + +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP="vpn unlimited" \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e COUNTRY=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=vpn unlimited + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - COUNTRY=Netherlands +``` + +## Required environment variables + +- `VPNSP=vpn unlimited` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `COUNTRY`: Comma separated list of [countries](#Servers) +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) + +| Country | City | Hostname | +| --- | --- | --- | +| Australia | Sydney | au.vpn unlimitedvpnaccess.com | +| Austria | | aus.vpn unlimitedvpnaccess.com | +| Belarus | | bl.vpn unlimitedvpnaccess.com | +| Belgium | | bg.vpn unlimitedvpnaccess.com | +| Brazil | | br.vpn unlimitedvpnaccess.com | +| Bulgaria | | bul.vpn unlimitedvpnaccess.com | +| Canada | Toronto | ca.vpn unlimitedvpnaccess.com | +| Canada | Vancouver | vanc.ca.west.vpn unlimitedvpnaccess.com | +| Chile | | chil.vpn unlimitedvpnaccess.com | +| Cyprus | | cp.vpn unlimitedvpnaccess.com | +| Czech | | czech.vpn unlimitedvpnaccess.com | +| Denmark | | den.vpn unlimitedvpnaccess.com | +| Finland | | fin.vpn unlimitedvpnaccess.com | +| France | | fr.vpn unlimitedvpnaccess.com | +| Germany | | gr.vpn unlimitedvpnaccess.com | +| Greece | | gre.vpn unlimitedvpnaccess.com | +| Hong | Kong | hk.vpn unlimitedvpnaccess.com | +| Hungary | | hg.vpn unlimitedvpnaccess.com | +| Iceland | | ice.vpn unlimitedvpnaccess.com | +| India | Bangalore | in.vpn unlimitedvpnaccess.com | +| Ireland | | ire.vpn unlimitedvpnaccess.com | +| Israel | | isr.vpn unlimitedvpnaccess.com | +| Italy | | it.vpn unlimitedvpnaccess.com | +| Japan | | jp.vpn unlimitedvpnaccess.com | +| Latvia | | lv.vpn unlimitedvpnaccess.com | +| Luxembourg | | lux.vpn unlimitedvpnaccess.com | +| Mexico | | mx.vpn unlimitedvpnaccess.com | +| Moldova | | md.vpn unlimitedvpnaccess.com | +| Netherlands | | nl.vpn unlimitedvpnaccess.com | +| New | Zealand | nz.vpn unlimitedvpnaccess.com | +| Norway | | no.vpn unlimitedvpnaccess.com | +| Poland | | pl.vpn unlimitedvpnaccess.com | +| Portugal | | por.vpn unlimitedvpnaccess.com | +| Romania | | ro.vpn unlimitedvpnaccess.com | +| Singapore | | singp.vpn unlimitedvpnaccess.com | +| Slovakia | | slk.vpn unlimitedvpnaccess.com | +| South | Korea | sk.vpn unlimitedvpnaccess.com | +| Spain | | sp.vpn unlimitedvpnaccess.com | +| Sweden | | swe.vpn unlimitedvpnaccess.com | +| Switzerland | | swiss.vpn unlimitedvpnaccess.com | +| Taiwan | | tw.vpn unlimitedvpnaccess.com | +| Thailand | | thai.vpn unlimitedvpnaccess.com | +| UAE | | uae.secureconnect.me | +| UK | London | uk.vpn unlimitedvpnaccess.com | +| USA | Atlanta | atl.east.usa.vpn unlimitedvpnaccess.com | +| USA | Chicago | chi.central.usa.vpn unlimitedvpnaccess.com | +| USA | Dallas | dal.central.usa.vpn unlimitedvpnaccess.com | +| USA | Las Vegas | lv.west.usa.vpn unlimitedvpnaccess.com | +| USA | Los Angeles | la.west.usa.vpn unlimitedvpnaccess.com | +| USA | Miami | fl.east.usa.vpn unlimitedvpnaccess.com | +| USA | New Jersey | nj.east.usa.vpn unlimitedvpnaccess.com | +| USA | New York | ny.east.usa.vpn unlimitedvpnaccess.com | +| USA | San Francisco | sf.west.usa.vpn unlimitedvpnaccess.com | +| USA | Seattle | sa.west.usa.vpn unlimitedvpnaccess.com | diff --git a/Servers/Vyprvpn Servers.md b/Setup/Providers/VyprVPN.md similarity index 64% rename from Servers/Vyprvpn Servers.md rename to Setup/Providers/VyprVPN.md index 5ec33c6..54af964 100644 --- a/Servers/Vyprvpn Servers.md +++ b/Setup/Providers/VyprVPN.md @@ -1,6 +1,50 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.vyprvpn) +## TLDR -The list of servers for VyprVPN is shown below: +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=vyprvpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=vyprvpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - REGION=Netherlands +``` + +## Required environment variables + +- `VPNSP=vyprvpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) + +## VPN server port forwarding + +By default, VyprVPN does not forward any port. + +You need to disable the NAT firewall in the Manage services section of your account at [account.vyprvpn.com](https://account.vyprvpn.com/) ([source](https://support.vyprvpn.com/hc/en-us/articles/360039668472-Does-VyprVPN-support-Port-Forwarding-)). + +All the ports will then be forwarded to you, so it's like you are running alone on the VPN server. + +Therefore, you only need to allow these ports through the gluetun firewall by setting the ports you need in `FIREWALL_VPN_INPUT_PORTS`. +For example `FIREWALL_VPN_INPUT_PORTS=8000,9000`. + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Country | Hostname | | --- | --- | diff --git a/Setup/Providers/WeVPN.md b/Setup/Providers/WeVPN.md new file mode 100644 index 0000000..5cad7cc --- /dev/null +++ b/Setup/Providers/WeVPN.md @@ -0,0 +1,45 @@ +## TLDR + +πŸ’ To use with Wireguard, see [Wireguard#Custom-setup](Wireguard#Custom-setup). + +1. Follow the steps here: [Client key](Client-key) + +```sh +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=wevpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e CITY=Amsterdam qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=wevpn + - OPENVPN_USER=abc + - OPENVPN_PASSWORD=abc + - CITY=Amsterdam +``` + +## Required environment variables + +- `VPNSP=wevpn` +- `OPENVPN_USER` +- `OPENVPN_PASSWORD` + +## Optional environment variables + +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `OPENVPN_PORT`: Custom OpenVPN server endpoint port + - For TCP: `53`, `1195`, `1199` or `2018` + - For UDP: `80`, `1194` or `1198` + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) + +TODO diff --git a/Servers/Windscribe Servers.md b/Setup/Providers/Windscribe.md similarity index 86% rename from Servers/Windscribe Servers.md rename to Setup/Providers/Windscribe.md index d8c1741..185382a 100644 --- a/Servers/Windscribe Servers.md +++ b/Setup/Providers/Windscribe.md @@ -1,6 +1,67 @@ -![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.servers.windscribe) +## TLDR -The list of servers for Windscribe is shown below: +```sh +# OpenVPN +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=windscribe \ +-e VPN_TYPE=openvpn \ +-e OPENVPN_USER=abc -e OPENVPN_PASSWORD=abc \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```sh +# Wireguard +docker run -it --rm --cap-add=NET_ADMIN -e VPNSP=windscribe \ +-e VPN_TYPE=wireguard \ +-e WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= \ +-e WIREGUARD_ADDRESS="10.64.222.21/32" \ +-e REGION=Netherlands qmcgaw/gluetun +``` + +```yml +version: "3" +services: + gluetun: + image: qmcgaw/gluetun + cap_add: + - NET_ADMIN + environment: + - VPNSP=windscribe + - VPN_TYPE=wireguard + - WIREGUARD_PRIVATE_KEY=wOEI9rqqbDwnN8/Bpp22sVz48T71vJ4fYmFWujulwUU= + - WIREGUARD_ADDRESS=10.64.222.21/32 + - REGION=Netherlands +``` + +## Required environment variables + +- `VPNSP=windscribe` + +### OpenVPN only + +- `OPENVPN_USER`: Your username (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)) +- `OPENVPN_PASSWORD`: Your password (get it from a generated config file from [fra.windscribe.com/getconfig/openvpn](https://fra.windscribe.com/getconfig/openvpn)) + +### Wireguard only + +- `WIREGUARD_PRIVATE_KEY` is your 32 bytes key in base64 format. Note this is specific by user and the same for all servers. +- `WIREGUARD_ADDRESS` is your IP network interface address in the format `xx.xx.xx.xx/xx`. Note this is specific by user and the same for all servers. + +## Optional environment variables + +- `REGION`: Comma separated list of [regions](#Servers) +- `CITY`: Comma separated list of [cities](#Servers) +- `SERVER_HOSTNAME`: Comma separated list of [server hostnames](#Servers) +- `OPENVPN_PORT`: Custom OpenVPN server endpoint port to use, see [this list of ports](https://windscribe.com/getconfig/openvpn) +- `WIREGUARD_ENDPOINT_PORT`: Custom Wireguard server endpoint port to use, which can be one of: `53`, `80`, `123`, `443`, `1194`, `65142` + +### VPN server port forwarding + +1. Follow the [Windscribe instructions](https://windscribe.com/support/article/37/what-is-ephemeral-port-forwarding-and-how-to-use-it) +1. In your container configuration, set `FIREWALL_VPN_INPUT_PORTS` to the port you have been assigned, for example: `FIREWALL_VPN_INPUT_PORTS=8099` + +## Servers + +⚠️ this information may become outdated, see [Outdated servers](Outdated-servers) | Region | City | Hostname | | --- | --- | --- | @@ -296,4 +357,4 @@ The list of servers for Windscribe is shown below: | WINDFLIX US | New York | wf-us-012.whiskergalaxy.com | | WINDFLIX US | New York | wf-us-013.whiskergalaxy.com | | WINDFLIX US | New York | wf-us-014.whiskergalaxy.com | -| WINDFLIX US | New York | wf-us-015.whiskergalaxy.com | \ No newline at end of file +| WINDFLIX US | New York | wf-us-015.whiskergalaxy.com | diff --git a/Setup/Test your setup.md b/Setup/Test your setup.md index 97bc385..cab2cf5 100644 --- a/Setup/Test your setup.md +++ b/Setup/Test your setup.md @@ -1,6 +1,6 @@ ![Visitors count](https://visitor-badge.laobi.icu/badge?page_id=gluetun.setup.testing) -Once your container is up and running, you may want to test your connection is correct and secured. +Once your container is up and running, you can test your connection is correct and secured (purely optional). ## Check your IP address diff --git a/FAQ/Wireguard.md b/Setup/Wireguard.md similarity index 71% rename from FAQ/Wireguard.md rename to Setup/Wireguard.md index ac67e16..7bcb3d3 100644 --- a/FAQ/Wireguard.md +++ b/Setup/Wireguard.md @@ -1,10 +1,39 @@ -# Wireguard +## Setup + +### Tight integrations + +Gluetun supports Wireguard with tight integrations with the following providers: + +- [Mullvad](Mullvad) +- [Ivpn](Ivpn) +- [Windscribe](Windscribe) + +And you should refer to their respective page to set up easily Wireguard with them. + +### Custom setup + +Gluetun supports custom Wireguard client configurations. + +This is especially useful with providers such as Torguard and VPN Unlimited. + +See the [setup for the *Custom* provider](Custom-provider) page for this. + +### Optional environment variables + +On top of provider specific Wireguard environment variables, the following are always available and optional: + +- `WIREGUARD_PRESHARED_KEY` is your 32 bytes pre shared key in base64 format +- `WIREGUARD_INTERFACE`: Wireguard network interface name to create and use. It defaults to `wg0`. + +## FAQ + +### Implementation Wireguard is implemented using imported packages from [git.zx2c4.com/wireguard-go](https://git.zx2c4.com/wireguard-go). It should be using the Kernel wireguard module if it is present and fallback to a Go user space Wireguard implementation otherwise, to maximize compatibility and performance. -## Performance +### Performance Wireguard is often known as *so much faster* than OpenVPN. Let's find out! diff --git a/_Sidebar.md b/_Sidebar.md index 4e5b33b..9933002 100644 --- a/_Sidebar.md +++ b/_Sidebar.md @@ -1,49 +1,68 @@ # Table of content -- [Home](https://github.com/qdm12/gluetun/wiki) -- Setup - - [Environment variables](Environment-variables) - - [32 bit setup](32-bit-setup) - - [Synology setup](Synology-setup) - - [Test your setup](Test-your-setup) - - [Connect to gluetun](Connect-to-gluetun) - - [Port mapping](Port-mapping) - - [Port forwarding](Port-forwarding) - - [Advanced setup](Advanced-setup) - - [Openvpn file](Openvpn-file) - - [Client key](Client-key) - - [Client certificate](Client-certificate) - - [Docker secrets](Docker-secrets) -- FAQ - - [Explanations](Explanations) - - [Docker image tags](Docker-image-tags) - - [Openvpn](Openvpn) - - [Wireguard](Wireguard) - - [Portainer](Portainer) +πŸ› [Found a bug in the Wiki?!](https://github.com/qdm12/gluetun/issues/new?assignees=&labels=%F0%9F%93%84+Wiki+issue&template=wiki+issue.md&title=Wiki+issue%3A+) + +## [Home](https://github.com/qdm12/gluetun/wiki) + +## Setup + +- Prerequisites + - [32 bit prerequisites](32-bit-prerequisites) + - [Synology prerequisites](Synology-prerequisites) +- Providers + - [Custom provider](Custom-provider) + - [Cyberghost](Cyberghost) + - [FastestVPN](FastestVPN) + - [Hidemyass](Hidemyass) + - [IVPN](IVPN) - [Mullvad](Mullvad) - - [Raspberry Pi](Raspberry-Pi) - - [Bandwidth speeds](Bandwidth-speeds) -- [HTTP Control server](HTTP-Control-server) -- [Servers](Servers-Readme) - - [Servers Readme](Servers-Readme) - - [Cyberghost Servers](Cyberghost-Servers) - - [Fastestvpn Servers](Fastestvpn-Servers) - - [HideMyAss Servers](HideMyAss-Servers) - - [Ivpn Servers](Ivpn-Servers) - - [Mullvad Servers](Mullvad-Servers) - - [Nordvpn Servers](Nordvpn-Servers) - - [Privado Servers](Privado-Servers) - - [Private Internet Access Servers](Private-Internet-Access-Servers) - - [PrivateVPN Servers](Privatevpn-Servers) - - [Protonvpn Servers](Protonvpn-Servers) - - [PureVPN Servers](Purevpn-Servers) - - [Surfshark Servers](Surfshark-Servers) - - [Torguard Servers](Torguard-Servers) - - [VPN Unlimited Servers](VPN-Unlimited-Servers) - - [VyprVPN Servers](Vyprvpn-Servers) - - [Windscribe Servers](Windscribe-Servers) - - [Updating Servers](Updating-Servers) -- Contributing - - [Contribute](Contribute) - - [Development](Development) -- [More information](More-information) + - [NordVPN](NordVPN) + - [Privado](Privado) + - [Private internet access](Private-internet-access) + - [PrivateVPN](PrivateVPN) + - [ProtonVPN](ProtonVPN) + - [PureVPN](PureVPN) + - [Surfshark](Surfshark) + - [Torguard](Torguard) + - [VPN Unlimited](VPN-Unlimited) + - [VyprVPN](VyprVPN) + - [WeVPN](WeVPN) + - [Windscribe](Windscribe) +- [Connect a container to gluetun](Connect-a-container-to-gluetun) +- [Connect a LAN device to gluetun](Connect-a-LAN-device-to-gluetun) +- [Port mapping](Port-mapping) +- [Wireguard](Wireguard) +- [Test your setup (optional)](Test-your-setup) +- [Docker image tags](Docker-image-tags) + +## Advanced setup + +- [OpenVPN options](OpenVPN-options) +- [VPN server port forwarding](VPN-server-port-forwarding) +- [Shadowsocks options](Shadowsocks-options) +- [HTTP proxy options](HTTP-proxy-options) +- [Firewall options](Firewall-options) +- [DNS options](DNS-options) +- [HTTP control server options](HTTP-control-server-options) +- [Outdated servers](Outdated-servers) +- [Updating servers](Updating-servers) +- [Docker secrets](Docker-secrets) +- [OpenVPN configuration file](OpenVPN-configuration-file) +- [Other options](Other-options) + +## FAQ + +- [Iptables errors](Iptables) +- [OpenVPN errors](OpenVPN) +- [Bandwidth speeds](Bandwidth-speeds) +- [Explanations](Explanations) + +## Contributing + +- [Contribute](Contribute) +- [Development](Development) + +## Other pages referenced + +- [Setup: OpenVPN client certificate](OpenVPN-client-certificate) +- [Setup: OpenVPN client key](OpenVPN-client-key)